Nut upsuser - Apr 2023 - upsset.conf : Restriction directives need updating

The good news:
While gathering information for this post, I solved the ORIGINAL problem 
I was going to post about, which was figuring out how to change the 
low-battery limit on my CyberPower PR3000LCDRTXL2U UPS with expansion 
chassis.  With three battery packs, the default 20% is absurd.


However, during the course of finally getting around to getting 
upsdet.cgi working, I found the security advice in upsset.conf to be 
highly outdated.

upsset.conf gives the following access restriction syntax ...

# 	<Files upsset.cgi>
#	deny from all
#	allow from your.network.addresses
#	</Files>

This syntax is long obsolete, at least in Apache.  It should currently 
be done in a fashion generally similar to this:


     ScriptAlias /upsstats.cgi /usr/share/nut/cgi/upsstats.cgi
     ScriptAlias /upsset.cgi /usr/share/nut/cgi/upsset.cgi

     <Directory "/usr/share/nut/cgi">
         Options +Includes +ExecCGI
         AllowOverride Limit
         <RequireAny>
             Require local
             Require ip aa.bb.cc.dd/nn
         </RequireAny>
     </Directory>



-- 
   Phil Stracchino
   Babylon Communications
   phils at caerllewys.net
   phil at co.ordinate.org
   Landline: +1.603.293.8485
   Mobile:   +1.603.998.6958

Thanks, I'll post an update :)

Jim

On Mon, Apr 24, 2023 at 10:37?PM Phil Stracchino via Nut-upsuser <
nut-upsuser at alioth-lists.debian.net> wrote:
> The good news:
> While gathering information for this post, I solved the ORIGINAL problem
> I was going to post about, which was figuring out how to change the
> low-battery limit on my CyberPower PR3000LCDRTXL2U UPS with expansion
> chassis.  With three battery packs, the default 20% is absurd.
>
>
> However, during the course of finally getting around to getting
> upsdet.cgi working, I found the security advice in upsset.conf to be
> highly outdated.
>
> upsset.conf gives the following access restriction syntax ...
>
> #       <Files upsset.cgi>
> #       deny from all
> #       allow from your.network.addresses
> #       </Files>
>
> This syntax is long obsolete, at least in Apache.  It should currently
> be done in a fashion generally similar to this:
>
>
>      ScriptAlias /upsstats.cgi /usr/share/nut/cgi/upsstats.cgi
>      ScriptAlias /upsset.cgi /usr/share/nut/cgi/upsset.cgi
>
>      <Directory "/usr/share/nut/cgi">
>          Options +Includes +ExecCGI
>          AllowOverride Limit
>          <RequireAny>
>              Require local
>              Require ip aa.bb.cc.dd/nn
>          </RequireAny>
>      </Directory>
>
>
>
> --
>    Phil Stracchino
>    Babylon Communications
>    phils at caerllewys.net
>    phil at co.ordinate.org
>    Landline: +1.603.293.8485
>    Mobile:   +1.603.998.6958
>
> _______________________________________________
> Nut-upsuser mailing list
> Nut-upsuser at alioth-lists.debian.net
> https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/nut-upsuser
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://alioth-lists.debian.net/pipermail/nut-upsuser/attachments/20230424/2f3006ab/attachment.htm>