Remstats Home


  About remstats
  architecture
  Release Notes
  FAQ
  Conventions
  Prerequisites
  Installation
      the remstats user
      the webgroup group
      cookies
      private functions
      remstats servers
      your web-server
  Configuration
  Configuration Tools
  Servers
  Collectors
  Updater
  Monitors
  pagemakers
  run-remstats2
  CGIs
  troubleshooting
  do-traceroutes
  Miscellany
  Thank-you
  Index


  Live Data

  Remstats was written by
  Thomas Erskine at the
  CRC in Canada and now
  at SourceWorks.

[Top] [Prev] [Next]

Getting your web-server ready for remstats

Choosing userid for remstats

Almost all the remstats web-pages are generated by some kind of CGI script. Many of them will read additional files not available under the html directory tree. In order to provide access to these files, the simplest way is to make sure that the scripts get run as the remstats user. You could also accomplish this by making the web-server user a member of the remstats group. The simplest way to make sure that the scripts can read all the files they need to, is to run a separate instance of the web-server software as the remstats user. You may have other methods of accomplishing this, depending on the web-server you're using. (See also remstats user.) Note that some scripts also require write access, specifically datapage.cgi (sometimes), alert.cgi (sometimes) and log-event.cgi (always).

Running CGI scripts under the remstats tree

You also may need to tell your web-server that xxx.cgi means that this file is a CGI script and needs to be run, instead of just displayed. With the apache web-server, you could add the following lines to the httpd.conf file:

	<Directory /var/lib/remstats/cgi>
	Options FollowSymlinks ExecCGI
	AddHandler cgi-script .cgi
	</Directory>

and

	ScriptAlias /remstats/static /var/lib/remstats/cgi-static
	<Directory /var/lib/remstats/cgi-static>
	Options FollowSymlinks ExecCGI
	</Directory>

Restricting access to CGI scripts

[You should also look at the access config-file.]

There are a few things you should do before telling others about remstats. Remstats comes with a few CGI scripts which you probably don't want to make publicly available and two that you certainly don't. ping.cgi, traceroute.cgi and whois.cgi should probably be restricted to your own organization, unless you don't mind letting anyone on the Internet run pings, traceroutes and whois queries from your domain. Rectricted to your domain, you only have to worry about your own people.

However, alert.cgi and log-event.cgi are a different kettle of fish. They will permit anyone who can run it to quench alerts and log comments about them. You will probably want to be a bit more restrictive about who you let run this.

Using the apache web-server, you can restrict the use of these CGIs using a .htaccess file something like this:

	# Note that this example uses the private network 192.168.0.0.
	# Stuff to make Apache expire the files to get them refreshed
	ExpiresActive on
	# images every 5 minutes, when the data gets updated
	ExpiresByType image/gif M300
	ExpiresByType image/png M300
	# html every day
	ExpiresByType text/html M300
	# What to allow
	Options ExecCGI FollowSymlinks Indexes
	<Files "^(whois.cgi|traceroute.cgi|ping.cgi)$">
	order deny,allow
	deny from all
	allow from 192.168. 127.0.0.1
	</Files>
	<Files "^(alert.cgi|log-event.cgi)$">
	order deny,allow
	deny from all
	allow from 192.168.20.1 192.168.23.3
	</Files>
	# How they're allowed in
	order deny,allow
	allow from all

I won't claim the IP#-based access-control is completely safe, but it's easy and keeps out casual browsers. If you really need to keep this information safe, use a secure web-server, say apache with mod_ssl. If that's not good enough, you ought to consider whether this stuff really belongs on a network at all.


[Top] [Remstats] [SourceWorks] [RRDtool] [SourceForge]
Last updated Sun Apr 3 12:05:20 UTC 2005 by <terskine@users.sourceforge.net>.