Please help me configuring Apache, PHP and FastCGI in a secure way

Hi all,

I'm trying to configure FastCGI to handle php files on a Windows
machine. I have added to httpd.conf the following lines, extracted
(more or less) from the FastCGI FAQ
(http://www.fastcgi.com/docs/faq.html#PHP):

LoadModule fastcgi_module modules/mod_fastcgi.so
<IfModule mod_fastcgi.c>
	Alias /php "C:/Program Files/wamp/apache2/cgi-bin"
	FastCgiServer "C:/Program Files/wamp/apache2/cgi-bin/php-cgi.exe"
-initial-env PATH=C:/PROGRA~1/wamp/php -initial-env
PHPRC=C:/PROGRA~1/wamp/php
	AddHandler php-fastcgi .php
	<Location /php>
		SetHandler fastcgi-script
		Options ExecCGI
	</Location>
	Action php-fastcgi /php/php-cgi.exe
	AddType application/x-httpd-php .php
</IfModule>

With this configuration, everything works (yay!) but I have found that
I'm able to download php-cgi.exe binary by typing
http://localhost/php/php-cgi.exe in my browser. Although I have no
idea of web servers security, I'm a little concerned with this, as it
doesn't seem to me like a good security practice.

I have tried adding different options to the configuration,
unsuccesfully. Adding Deny from All to the Location directive made
Apache to crash, for example. And adding Allow from 127.0.0.1 didn't
do a thing, I could still download the binary from a PC connected to
the LAN.

Any little help is appreciated, thanks!
___________________________________
fastcgi-developers mailing list
http://fastcgi.com/fastcgi-developers/