disable apache cgi-bin because dolibarr doesn't seem to use it

[JonBendtsen]

disable apache cgi-bin because dolibarr doesn't seem to use it and then the container should not have it by default

[creekorful]

Hello @JonBendtsen,

I don't think we need this PR if we add a way to disable the modules here in this PR #47. That would be much more convenient.

[JonBendtsen]

Hello @JonBendtsen,

I don't think we need this PR if we add a way to disable the modules here in this PR #47. That would be much more convenient.

No, because even if people can use PR #47 to disable this module - why would they have to do it? The dolibarr container should be a safe as possible, and it does not need the CGI-BIN inside apache. Leaving cgi-bin in would slightly increase the risk of someone potentially placing a file in there which then can be execute. It is safer that we simply disable the apache configuration that by far most dolibarr installations that uses the this dolibarr container will end up having. Safety first.

[creekorful]

Hi @JonBendtsen,

The defaults of serve-cgi-bin.conf makes it so it is not easily possible to execute arbitrary cgi files because you'll need to place them into /usr/lib/cgi-bin directory (which is outside Dolibarr directory anyway so not easily accessible)

See config file for example:

<IfModule mod_alias.c>
	<IfModule mod_cgi.c>
		Define ENABLE_USR_LIB_CGI_BIN
	</IfModule>

	<IfModule mod_cgid.c>
		Define ENABLE_USR_LIB_CGI_BIN
	</IfModule>

	<IfDefine ENABLE_USR_LIB_CGI_BIN>
		ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
		<Directory "/usr/lib/cgi-bin">
			AllowOverride None
			Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
			Require all granted
		</Directory>
	</IfDefine>
</IfModule>

The problem here is not that we don't want to secure Apache installation but rather that we should do so while keeping the image minimal (feature wise) and less opinionated as possible.

Let me think about it.

[JonBendtsen]

Hi @JonBendtsen,

The defaults of serve-cgi-bin.conf makes it so it is not easily possible to execute arbitrary cgi files because you'll need to place them into /usr/lib/cgi-bin directory (which is outside Dolibarr directory anyway so not easily accessible)

True? but why keep it in if we don't need it for Dolibarr?

[creekorful]

Can we move this to another RUN instruction just after this one and before the "Get Dolibarr" one?

Something like this:

# Disable useless Apache modules to provide safe defaults
RUN a2disconf serve-cgi-bin

[creekorful]

Since there is a consensus for the base image to provide sane (and safe) defaults, let's move on with this PR.

On a side note I would be great to check the list of enabled apache modules and use this PR to disable all modules who does not need to be enabled.

If the user is willing to enable a module this could be done using the custom init scripts like @tuxgasy explained in another PR.

Cheers,

[JonBendtsen]

replaced by #54

[creekorful]

Closing as superseded by #54.