For security reasons we are reviewing our use of user authored CGI scripts that are currently running on our web services.

Those CGIs that run as the author, such as those on homepages.inf.ed.ac.uk and sweb.inf.ed.ac.uk, are not under review at the moment, but other CGIs that run as the web server daemon are.

The main services this affects are CGIs on www.inf.ed.ac.uk and those on groups.inf.ed.ac.uk.

In the first instance we’ve looked at the accesses of all CGIs on www.inf.ed.ac.uk, and if a CGI has not been accessed in the last 6 months, we no longer serve it from the web server. There is also a default deny for any new CGIs added to www.inf, so those that have access to the CGI area of www.inf will need to ask computing staff to enable serving of any new CGI. At this point we’ll want to review its contents, and discuss how accessible it needs to be, e.g. do you expect only current students and staff to access it.

We’ll then start security reviewing the remaining active CGIs, and contacting authors/owners where appropriate.

This is only the beginning of a longer process, and we’ll start looking at CGIs on groups.inf.ed.ac.uk next.

If you have any old CGIs that are nolonger used, then removing them will help us with our review, and increase the security of the Informatics services.

Neil

Review of www.inf.ed.ac.uk CGIs / Computing Systems by is licensed under a