how to protect the search.cgi in IIS?

[kenny]

can someone please help me protect the search.cgi file from users that are not login to our site?

I followed the directions from the page below, and i am able to protect my protectedsearch.asp file. But any public user can still go to www.site.com/search.cgi instead of www.site.com/protectedsearch.asp

http://www.wrensoft.com/zoom/support/faq_ssi.html#ssi_cgi

Server is Windows 2003 running IIS.

[David]

As you have wrapped the script in your own ASP code, then the user won't ever know that the file search.cgi exists on your system.

One simple solution would be to just place it in a folder with a random folder name.
www.site.com/secret_name/search.cgi

Not 100% secure, but maybe enough, depending on what you are trying to protect. Remember that you also need to protect the index files (*.zdat) if you want zero leakage.

Another solution would be to disable the serving of .CGI & .ZDAT files in IIS. Your ASP script should still be able to do a shell execute on the CGI even if IIS doesn't serve that file type.

Might even be able to place the entire /secret_name/ folder outside of the web site folder. I haven't tested this however.

[kenny]

I moved the entire folder outside of the wwwroot folder, updated the path to the new cgi in IIS web extensions, and it works great. Now all the ZDAT and cgi files are protected.

Thanks for a great product!

I do have a few more issues to resolve before we can go live.
1. indexing xls file inside a zip file not working
2. zip thumbnail not showing the correct image file

[David]

Have you turned on indexing of both .ZIP and .XLS files?
Are other files in ZIP files being indexed?
Did you check the log for errors?
Are you sure that the ZIP file or Excel file are not password protected?

For the Zip thumb. What settings do you have? What image is being displayed if not the right one? In the search results do they point to the Zip file itself or the file inside the Zip file?

[kenny]

both .ZIP and .XLS are turned on. no password set in files
I did a test and indexed the ZIP file two ways.

1. by direct link. www.site.com/downloads/file.zip
this method works great, all the contents of the XLS file are indexed.
as expected, the thumbnail returned from this url is the thumbnail set for ZIP files.
the search results returns both .ZIP and .XLS file, tested by searching **

2. by a download script link. www.site.com/downloadscript.asp?file=file.zip
this method only indexes the meta info from the ZIP file.
the thumbnail returned from this url is the thumbnail set for ASP files.
the search results returns only the content from .ZIP file, also tested by searching **

[David]

Maybe your downloadscript.asp download script is returning the wrong mime type?

In other words maybe your server flags the file type as text or HTML rather than a Zip file. It is easy enough to check, what is the full URL to the downloadscript.asp script?

[kenny]

i'll send you a PM for the link.
as far as i know the correct MIME type is set.
ZIP
"application/x-zip-compressed"

XLS
"application/vnd.ms-excel"

[Ray]

We have confirmed that this is a problem in the current V6 release. The problem occurs when there are more than 2 levels of filetypes in one URL, so here, we have an ASP page that actually serves a ZIP file, inside of which, is a XLS file.

This is something we have addressed in the next major release (V7). An early Alpha of which should be available in a couple of weeks. So you might want to contact us again then.