CGI interface does not work after installation

[Xander]

System Information:

Description: Ubuntu 18.04.2 LTS
Release: 18.04

Clean install, sudo apt update, sudo apt upgrade then sudo apt install backuppc

Package installed from ubuntu repository: Backuppc 3.3.1-4ubuntu1

After installing the package, navigating to http://<hostname>/backuppc prompts firefox to download the page instead of viewing it.

To rectify this I had to input the following two commands:

sudo a2disconf serve-cgi-bin
sudo service apache2 restart

This was also reported on the github page:
https://github.com/backuppc/backuppc/issues/276

Has this already been fixed?

[Bryce Harrington (bryce)]

$ lxc exec bionic-19-032-1 -- bash
$ uname -a
Linux bionic-19-032-1 4.15.0-54-generic #58-Ubuntu SMP Mon Jun 24 10:55:24 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.2 LTS"

$ apt-get -y install backuppc
$ apt-get -y install lynx

### Reset password to 'password' or whatever
$ htpasswd /etc/backuppc/htpasswd backuppc

$ lynx bionic-19-032-1
This prompts for basic auth, entered:
  username: backuppc
  password: password

This then shows binary garbage, starting with "ELF>@@8 @@@@88 8@..."

Opening the lxc container's network in firefox also prompts for auth, and then displays a dialog:

-----------------------------
"You have chosen to open:

  which is: application/octet-stream (6.0 KB)
  from: http://nn.nnn.nn.nnn
Would you like to save this file?
-----------------------------

Then performing the suggested workaround:

$ a2disconf serve-cgi-bin
Conf serve-cgi-bin disabled.
To activate the new configuration, you need to run:
  systemctl reload apache2
$ service apache2 restart

This brings up a BackupPC Server Status page.

In firefox, bringing up "http://10.208.83.246/backuppc/index.cgi?action=summary" then works as well.

[Bryce Harrington (bryce)]

I reproduced similar behavior on eoan with the same steps.

Here's the warnings that displayed during the install on eoan:

  adduser: Warning: The home directory `/var/lib/backuppc' does not belong to the user you are currently creating.
  ...
  dpkg-statoverride: warning: deprecated --force option; use --force-all instead
  ...
  To activate the new configuration, you need to run:
    systemctl restart apache2
  Your MPM seems to be threaded. Selecting cgid instead of cgi.
  Enabling module cgid.

I did not do the `a2disconf serve-cgi-bin` step, only `systemctl restart apache2`, it came up ok in lynx.

[Bryce Harrington (bryce)]

Reviewing changes between the bionic and eoan versions, I notice they've changed the default access:

backuppc (3.3.2-1) unstable; urgency=low
  * debian/apache.conf:
    + Only grant access from localhost by default (as by default HTTPS is
      not enforced). Mention that in NEWS.Debian.

and access permissions on the cgi-bin directory:

-rules: install --mode=4750 index.cgi debian/backuppc/usr/lib/backuppc/cgi-bin
+rules: install --mode=755 index.cgi debian/backuppc/usr/lib/backuppc/cgi-bin

This may improve the situation a little, although the problem of the cgi script not getting handled as cgi remains. For security conditions, this would need to adhere to ubuntu's policy on enabling cgi-bin on installation.

Updating documentation is a good idea - suggestions would be welcomed.

[Brian Murray (brian-murray)]

The Eoan Ermine has reached end of life, so this bug will not be fixed for that release

[David Torrey (dotj)]

FWIW, I was able to reproduce this bug on 20.04.5 and 22.04.1 today as well as 18.04.6. Interestingly, the workaround (a2disconf and a restart of apache2) worked on bionic and jammy, but did not change the behavior of focal.

[Lucas Kanashiro (lucaskanashiro)]

Thanks for testing it David. I added tasks for Focal and Jammy as well. This bug is in our backlog, it will be investigated once we have some time.