Even though my admin directory is password protected, if one guesses the path of my .db files in the data dir, he can download them easily.

The problem is that my cgi-bin directory is inside the htdocs folder in an IIS4 server.

Has anyone succeded in securing the data directory outside the web directory while keeping all .cgi and .pl scripts inside? What kind of mod would this require?

In Unix Apache I use ScriptAlias in httpd.conf, but in colorful Winnt?

Thanx in advance, Daniele Gubert.

Ok dumb question because I honestly don't know.. but surely if you set the db file to CHMOD 700 then it can't be read or executed outside of the server...

That would mean that you can't have any other hosts writing to your db but then why would you want to?

Can someone tell me if this is right?

Oh and yes, I do know that someone with ftp access could get into it but I think we're talking about web access though aren't we.

Just a thought cos I'd love to know if I'm right

Cheers

Martin

The impossible we can handle now
Miracles take a little longer

Sounds like a pretty reasonable answer to me. I would have thought that FTP access is protected with a userid and password.

Also, it's a good idea to place an index.html file in each subdirectory because this prevents a directory listing being sent to the browser.

Martin Webster
--
Cebidae's UK Internet Resource
http://www.cebidae.co.uk/

They can have your database in a matter of minutes anyway.
TeleportPro - download all your site (it's static, after all) - analize it with a simple parser - import it in a database of their own.
I know people who did this with a web-directory with 10 000 links and it took them less than an hour.

Hmm, perhaps this is a possible suggestion for a MOD then.. something that looks at the number of page requests and blocks them somehow...

It's likely to be a seperate program but I'd have thought something like this would be possible. Although to tell you the truth, with some sites like mine for example they'd have a job getting half the data out using such a method.

But hey, this is about reducing the chances or making it plain hard for people like that anyways...

Martin