Found a great alternate to Matt Wrights FormMail

[AlaskanWolf]

http://www.home-port.net/formmail/

I set this up and the tests are great, it notifies the ISP of any jerk that thinks they can scan out formmail and exploit it.

The problem is, im having problems with the global setup, i want to set it so it looks like


# Global Alias for entire server
Alias /cgi-bin/formmail.pl /home/mypath/www/formmail/formmail.php
Alias /cgi-bin/formmail.cgi /home/mypath/www/formmail/formmail.php
Alias /cgi-bin/FormMail.cgi /home/mypath/www/formmail/formmail.php
Alias /cgi-bin/FormMail.pl /home/mypath/www/formmail/formmail.php

But when i try it, nothing happens, Anyone got any suggestions? if this can be setup, its a great idea, yah i know formmail is also at cgi-sys but theres no way to force my customers to use it. so the next ideal step is to just cut them off at the server level so if they are still using formmail in their cgi-bin, they would unknowingly be using our formmail

 

[AlaskanWolf]

PS: i can get it to work say if i setup something like

Alias /cgi-bina/formmail.cgi /home/directory/www/formmail/formmail.php

 

[AlaskanWolf]

i take it no one really cares if your customers get exploited or not ?

 

[haze]

Mate, have you tried removing all of the cgi-bin aliases?

 

[AlaskanWolf]

when i do that, then their entire cgi-bin wont work, its been driving me up the wall

I can get domain.com/(alias) such as anydomain.com/formmail.pl to work, but once i put the alias to point to cgi-bin/ it wont work

 

[Brad]

Gary,

Did you ever get this to work correctly? This would be a nice script to have!!

Brad

 

[Brad]

I got it to work with the Redirect method.

The redirect will override the original cgi-bin directives and redirect to the script.

Although it is not as transparent, it does allow the script to work as needed and you will be notified by the script, etc.

Redirect /cgi-bin/formmail.pl http://foo2.bar.com/formmail/formmail.php

I think this would work fine.

Unfortunately, the request url is the redirect, thus we would not see the original request url.

 

[AlaskanWolf]

well i got that to work in the past, but its not what im really looking for, which is total stealth