Unix & Linux Stack Exchange
Q&A for users of Linux, FreeBSD and other Unix-like operating systems
Latest Questions
Getting HTTPS web interface for transmission with Lighttpd reverse proxy
lighttpd reverse proxy
Do you want to expand and replace this existing certificate with the new
certificate?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(E)xpand/(C)ancel: E
Renewing an existing certificate for my.domain.com and my.otherdomain.com
Performing the following challenges:
http-01 challenge for aws.andrewterhorst.com
Using the webroot path /var/www for all unmatched domains.
Waiting for verification...
Challenge failed for domain my.otherdomain.com
http-01 challenge for my.otherdomain.com
Cleaning up challenges
Some challenges have failed.
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: my.otherdomain.com
Type: unauthorized
Detail: Invalid response from
http://my.otherdomain.com/.well-known/acme-challenge/p16SmhyufIGQ75fnhWQ4zxf49TCLfnX4SoWRmBqAHBg
server.feature-flags += ("server.h2c" => "enable")
server.feature-flags += ("server.graceful-shutdown-timeout" => 5)
#server.feature-flags += ("server.graceful-restart-bg" => "enable")
# strict parsing and normalization of URL for consistency and security
# https://redmine.lighttpd.net/projects/lighttpd/wiki/Server_http-parseoptsDetails
# (might need to explicitly set "url-path-2f-decode" = "disable"
# if a specific application is encoding URLs inside url-path)
server.http-parseopts = (
"header-strict" => "enable",# default
"host-strict" => "enable",# default
"host-normalize" => "enable",# default
"url-normalize-unreserved"=> "enable",# recommended highly
"url-normalize-required" => "enable",# recommended
"url-ctrls-reject" => "enable",# recommended
"url-path-2f-decode" => "enable",# recommended highly (unless breaks app)
#"url-path-2f-reject" => "enable",
"url-path-dotseg-remove" => "enable",# recommended highly (unless breaks app)
#"url-path-dotseg-reject" => "enable",
#"url-query-20-plus" => "enable",# consistency in query string
)
index-file.names = ( "index.php", "index.html" )
url.access-deny = ( "~", ".inc" )
static-file.exclude-extensions = ( ".php", ".pl", ".fcgi" )
# default listening port for IPv6 falls back to the IPv4 port
include_shell "/usr/share/lighttpd/use-ipv6.pl " + server.port
include_shell "/usr/share/lighttpd/create-mime.conf.pl"
include "/etc/lighttpd/conf-enabled/*.conf"
#server.compat-module-load = "disable"
server.modules += (
"mod_dirlisting",
"mod_staticfile",
)
# proxy settings
$HTTP["host"]=~ "my.otherdomain.com" {
proxy.balance = "fair"
proxy.server = ("" =>
(
( "host" => "192.168.0.261", "port" => 80 ),
( "host" => "192.168.0.261", "port" => 443 )
))
}
Technically, the proxy settings should be in 10-proxy.conf. I need to run this command:
lighty-enable-mod proxy
This creates a symbolic link in /etc/lighttpd/conf-enabled to 10-proxy.conf in /etc/lighttpd/conf-available. I read I could simply add proxy settings in lighttpd.conf - it was not necessary to use 10-proxy.conf.
The current set-up means incoming traffic to my.otherdomain.com ends up on the second weewx machine. However, certbot needs to communicate out. I am confused about where I should run certbot - from my weewx machine or from my NextCloud machine?
I am not a Linux boffin and need some guidance on how to set up lighttpd to do forward and reverse proxies so my weewx machine can be secure. Most of the posts touching on this refer to Apache, nginx, or some specific web application setup. The syntax of the lighttpd conf settings is rather confusing using regex like notation. For example:
$HTTP['host'] =~ '^(www.example.com)$' {
url.rewrite-once = ('^/(.*)' => '/vhost/http/%0/$1')
# In lighttpd we alter the path manually using rewrite rule. %0
# refers to the hostname and $1 is the path.
proxy.server = ( '' =>
( (
'host' => '127.0.0.1',
'port' => 8080
) )
)
}
There is no step by step tutorial in plain simple English for simpletons such as me.
Howto restrict IPv6 listening address in lighttpd on Debian
/etc/lighttpd/lighttpd.conf
server.port = 80
server.bind = "127.0.0.1"
server.use-ipv6 = "disable"
However, the webserver is running on all IPv6 addresses, too:
# netstat -tupan|grep lighttpd
tcp 0 0 127.0.0.1:80 0.0.0.0:* LISTEN 519887/lighttpd
tcp6 0 0 :::80 :::* LISTEN 519887/lighttpd
With the following line instead of the formerly printed lines in the config file, the server won't start:
server.bind = "[::1]"
It means, I've got only an error message about a used port, but the port ist not used!
# netstat -tupan|grep LISTEN|grep 80/; lighttpd -f /etc/lighttpd/lighttpd.conf; netstat -tupan|grep LISTEN|grep 80/
2023-04-27 16:50:24: (network.c.537) can't bind to socket: [::1]:80: Address already in use
How I can restrict lighttpd to listen only on localhost (only IPv4, only IPv6 or IPv4 and IPv6)
Trying to set up self signed certificates on other devices
How to configure lighttpd to redirect HTTP to HTTPS?
lighttpd: ajax request prints the content of cgi script instead of running it
The button calls a function and then download the file created with .cgi script.
The function of the ajax request:
function submit_form()
{
var div1 = document.getElementById("extern");
var data = {};
data = recursive_f(div1, 0, 0);
output = JSON.stringify(data);
var xhr_lv = new XMLHttpRequest();
xhr_lv.onreadystatechange=function()
xhr_lv.open("POST", "/scripts_files/json.cgi", true);
xhr_lv.setRequestHeader('Content-Type', 'application/json; charset=UTF-8');
xhr_lv.send(output);
}
C program that generates the .cgi script:
#include
#include
#include
int main(int argc, char* argv[])
{
char* post_len_v = getenv("CONTENT_LENGTH");
long post_len = strtol(post_len_v, NULL, 10);
char* post_msg = (char*)malloc(post_len + 1);
FILE *fp;
if (!post_msg)
{
return 0;
}
fgets(post_msg, post_len + 1, stdin);
fp = fopen("/mnt/userfs/lighttpd/www/scripts_files/conf.json", "w");
fprintf(fp, "%s", post_msg);
fclose(fp);
printf("Content-type: application/json\n\n");
return 0;
}
Lighttpd configuration file:
server.modules = (
"mod_indexfile",
"mod_access",
"mod_redirect",
"mod_alias",
"mod_compress",
"mod_dirlisting",
"mod_staticfile",
"mod_auth",
"mod_authn_file",
"mod_accesslog",
"mod_cgi",
#"mod_rewrite",
#"mod_status"
#"mod_fastcgi"
)
server.document-root = "/mnt/userfs/lighttpd/www"
server.errorlog = "/mnt/userfs/lighttpd/log/error.log"
server.breakagelog = "/mnt/userfs/lighttpd/log/breakage.log"
index-file.names = ("index.html", "main.html", "file_upload.html")
mimetype.assign = (
".class" => "application/java-vm",
".js" => "application/javascript",
".mjs" => "application/javascript",
".json" => "application/json",
".jsonld" => "application/ld+json",
".wmx" => "video/x-ms-wmx",
".wvx" => "video/x-ms-wvx",
".avi" => "video/x-msvideo",
".movie" => "video/x-sgi-movie",
".ice" => "x-conference/x-cooltalk",
".sisx" => "x-epoc/x-sisx-app",
".vrm" => "x-world/x-vrml",
"README" => "text/plain; charset=utf-8",
"Makefile" => "text/x-makefile; charset=utf-8",
# enable caching for unknown mime types:
#"" => "application/octet-stream"
)
mimetype.use-xattr = "disable"
url.access-deny = ( "~", ".inc" )
static-file.exclude-extensions = ( ".php", ".pl", ".fcgi" )
server.port = 80
server.username = "midac"
server.groupname = "midac"
#compress.cache-dir = "/var/cache/lighttpd/compress/"
compress.filetype = ( "application/javascript", "text/css", "text/html", "text/plain" )
cgi.assign = ( ".cgi" => "" )
$HTTP["url"] =~ "/admin" {
auth.backend = "htpasswd"
auth.backend.htpasswd.userfile = "/mnt/userfs/lighttpd/www/admin/.htpasswd"
auth.require = ( "/admin" => (
"method" => "basic",
"realm" => "main",
"require" => "valid-user")
)
}
$HTTP["url"] =~ "/user" {
auth.backend = "htpasswd"
auth.backend.htpasswd.userfile = "/mnt/userfs/lighttpd/www/user/.htpasswd"
auth.require = ( "/user" => (
"method" => "basic",
"realm" => "main",
"require" => "valid-user")
)
}
$HTTP["url"] =~ "/user2" {
auth.backend = "htpasswd"
auth.backend.htpasswd.userfile = "/mnt/userfs/lighttpd/www/user2/.htpasswd"
auth.require = ( "/user2" => (
"method" => "basic",
"realm" => "main",
"require" => "valid-user")
)
}
I tried also with sample cgi script, but I got this result:
#!/bin/sh
echo hello
so the content of the cgi script.
The type of POST request is octet-stream, seems that cgi_mod not working properly, or I missed something on the configuration file of lighttpd.
Any suggestions?
Setting www-data (lighttpd) as sudoer not working
Process (mplayer) doesn't read from named pipe when started from webserver (lighttpd)
-slave -input file=/srv/mplayer.fifo
. (So mplayer reads and executes commands from that file.) In order to skip to the next song, one of the webserver scripts writes pt_skip 1
to /srv/mplayer.fifo
. This indeed works when mplayer was run from command line. But when started from lighttpd, mplayer does not read commands from /srv/mplayer.fifo
. I don't understand why. Here's what I did:
Setup
$ mkfifo /srv/mplayer.fifo
$ chmod o+w /srv/mplayer.fifo
$ ls -l /srv/mplayer.fifo
prw-r--rw- 1 root root 0 Aug 7 12:11 /srv/mplayer.fifo
Test (ran from command line)
$ sudo -u www-data mplayer -ao alsa -slave -input file=/srv/mplayer.fifo -playlist /srv/list -shuffle
$ lsof /srv/mplayer.fifo
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
mplayer 21059 www-data 4u FIFO 179,2 0t0 2359331 /srv/mplayer.fifo
$ ps aux | grep mplayer
root 21058 0.0 0.2 4680 2400 pts/0 S+ 12:13 0:00 sudo -u www-data mplayer -ao alsa -slave -input file=/srv/mplayer.fifo -playlist /srv/list -shuffle
www-data 21059 11.6 3.1 127928 30008 pts/0 SL+ 12:13 0:01 mplayer -ao alsa -slave -input file=/srv/mplayer.fifo -playlist /srv/list -shuffle
That's like expected. But if I run mplayer from lighttpd ...
$ cat /var/www/html/play
#!/usr/bin/bash
mplayer -ao alsa -slave -input file=/srv/mplayer.fifo -playlist /srv/list -shuffle &
... **it starts mplayer**, but the mplayer instance is not reading from /srv/mplayer.fifo
. lsof
doesn't produce any output:
$ lsof /srv/mplayer.fifo
$ ps aux | grep mplayer
www-data 21177 15.3 3.1 128212 29744 ? SL 12:30 0:01 mplayer -ao alsa -slave -input file=/srv/mplayer.fifo -playlist /srv/list -shuffle
I can also see mplayer is not reading from the pipe, because writing to it blocks. The mplayer logs don't show anything unusual. Do you have an idea why mplayer doesn't read from the named pipe when run from lighttpd?
How to troubleshoot lighttpd service not starting up?
Pass traffic from one network interface to another
ethpi1
, ethpi2
, ethpi3
, and ethpi4
with IP addresses 10.0.11.2
, 10.0.12.2
, 10.0.13.2
, and 10.0.14.2
respectively. The RPi4 is on a network I have access to with a known, but not controlled, IP address like 192.168.0.2
or something. I won't have physical access to the device once it is set up. All 5x RPi's have a FTP (proftpd) server, a HTTP (lighttpd) server, and SSH enabled.
I am trying to figure out how to access these servers on the RPiZ's without first SSHing into the RPi4. This involves multiple related questions. If I have a computer on the same ethernet network as the RPi4, how do I direct traffic to/from the RPiZ's?
How to compile lighttpd .tar file using cygwin to run executable file in Windows 10
lighttpd won't start even with the right permissions
Lighttpd when running python CGI reports - 403 forbidden - Ubuntu
for count in range(1,100) print'Hello World...' print "/p> Finally, restart the lighttpd service. #service lighttpd restart But, when I try to access the page it says- 403 forbidden Here is my folder with permission /home/httpd. /home/httpd$ ls -l total 8 drwxr-xr-x 2 www-data www-data 4096 Apr 3 17:56 cgi-bin drwxr-xr-x 2 www-data root 4096 Apr 3 16:41 html Here is the hello.py /home/httpd/cgi-bin$ ls -l total 4 -rwxrwxrwx 1 root www-data 244 Apr 3 17:56 hello.py The log says that it is still looking for php, html files rather than my python binary? read(7, "GET / HTTP/1.1\r\nHost: 10.0.2.15\r"..., 4159) = 328 stat("/home/httpd/", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat("/home/httpd/index.php", 0x7ffee411b9f0) = -1 ENOENT (No such file or directory) stat("/home/httpd/index.html", 0x7ffee411b9f0) = -1 ENOENT (No such file or directory) stat("/home/httpd/index.lighttpd.html", 0x7ffee411b9f0) = -1 ENOENT (No such file or directory) setsockopt(7, SOL_TCP, TCP_CORK, , 4) = 0 writev(7, [{iov_base="HTTP/1.1 403 Forbidden\r\nContent-"..., iov_len=134}, {iov_base="
Setup subdomain on a lighttpd server
Why is lighttpd saying "unknown config-key: accesslog.filename"?
accesslog.filename
exists, it's an option of the server.
I found it on their website: http://redmine.lighttpd.net/wiki/lighttpd/Docs:ConfigurationOptions
What can I do?
xinetd cannot launch lighttpd
lighttpd
when someone tries to connect to port 80.
I started with a simple test script to see if anything was working:
/etc/xinetd.d/www
service www
{
disable = no
socket_type = stream
protocol = tcp
port = 80
log_on_success += USERID
log_on_failure += USERID
server = /usr/server_test.sh
user = root
instances = UNLIMITED
wait = no
log_type = SYSLOG daemon debug
}
where /usr/server_test.sh
:
#!/bin/sh
echo "www connection"
lighttpd -D -f /usr/lighttpd.conf &
webconfig -c /usr/cppcms.js &
service xinetd restart
When I try:
nc localhost 80
I get:
www connection 2013-11-25 16:37:13: (network.c.345) can't bind to port: 80 Address already in use
How do I get xinetd
and lighttpd
to work together, not fight over same port?
Apache vs lighthttpd : different behaviours with mime type
Apache
, while the latter is using lighthttpd
.
In lighhttpd
the .mobileconfig
file is opened and "executed" e.g. it opens SysPrefs automatically, while in Apache that is not happening.
I have already noticed lighhtpd
is much more lax concerning proper Content-Type
definitions, however the issue at hand is that Safari will load and "auto-execute" .mobileconfig
files properly with lighthttpd
whilst the same does not happen with Apache
.
What further irks me it that in both servers I have defined properly the corresponding mime.type
as in:
lighthttpd.conf
$HTTP["url"] =~ "\.mobileconfig$" {
setenv.add-response-header = ( "Content-Disposition" => "attachment" )
mimetype.assign = (".mobileconfig" => "application/x-apple-aspen-config",
"" => "application/octet-stream")
}
As in Apache it is:
dovpn.conf (vhost)
AddType application/x-apple-aspen-config .mobileconfig
The first clue of a difference actually seems to stem from that add-response-header
directive in lighthttpd
.
In the generated HTML, I have:
a download="profile.mobileconfig" href="../upload/8bd16b26-1473-4994-9803-8268a372cd0d.mobileconfig" type="application/octet-stream">Download automatic profile/a
and I do an automatic download of that via Javascript
//If in Safari - download via virtual link click
if (window.downloadFile.isSafari) {
//Creating new link node.
var link = document.createElement('a');
link.href = sUrl;
if (link.download !== undefined) {
//Set HTML5 download attribute. This will prevent file from opening if supported.
var fileName = sUrl.substring(sUrl.lastIndexOf('/') + 1, sUrl.length);
link.download = fileName;
}
//Dispatching click event.
if (document.createEvent) {
var e = document.createEvent('MouseEvents');
e.initEvent('click', true, true);
link.dispatchEvent(e);
return true;
}
}
The content of the generate page also only has as Content-Type:
Content-Type: text/html\n\n
both in Apache and lighthttpd. I sniffed over the wire, and there are no apparent changes made to Content-Type made via lighthttpd
.
Will I be able to replicate similar functionality of setenv.add-response-header
with Apache?
I have already tried to add to the Apache host:
Header set Content-Disposition attachment
and
SetEnvIf Request_URI "\.mobileconfig$" change_header
Header set Content-Disposition attachment env=change_header
and
SetEnvIf Request_URI "\.mobileconfig$" change_header
Header always add "Content-Disposition" "attachment" env=change_header
and
Header append Content-Disposition attachment
I also have tried, in the actual directory, creating an .htaccess
file with:
ForceType application/octet-stream
Header append Content-Disposition "attachment"
Allow from all
and
ForceType application/octet-stream
Header add Content-Disposition "attachment"
Allow from all
In both cases, besides attachment
, I also used "attachment"
.
Please note mod_headers is active by default in Apache/Debian 9, and none of these alternatives worked out.
Actually, I just remembered lighthttpd
is using HTTP, and Apache
HTTPS. I tested it out lighthttpd with HTTPS, and it also works over HTTPS, while Apache does not.
Output of curl -k -I https://localhost/cgi-bin/vpn.py
in lighthttpd server:
HTTP/1.1 200 OK
Content type: text/html
Content-Length: 331
Date: Thu, 01 Jun 2017 09:03:26 GMT
Server: lighttpd/1.4.45
Output of curl -k -I https://localhost/cgi-bin/vpn.py
in Apache server:
HTTP/1.1 200 OK
Date: Thu, 01 Jun 2017 09:05:25 GMT
Server: Apache
Vary: Accept-Encoding
X-Frame-Options: sameorigin
Content-Type: text/html; charset=UTF-8
Furthermore, in Apache too:
$curl -k -I https://localhost/download/xxx.mobileconfig
HTTP/1.1 200 OK
Date: Thu, 01 Jun 2017 09:13:35 GMT
Server: Apache
Last-Modified: Thu, 01 Jun 2017 03:08:57 GMT
ETag: "1f3b-550dd5b89d8df"
Accept-Ranges: bytes
Content-Length: 7995
X-Frame-Options: sameorigin
Content-Disposition: attachment
Content-Type: application/x-apple-aspen-config
Using Safari->Develop->Show web Inspector->Debugger->clicking on main page->Copy as curl only returns me "curl 'https://xxxx/cgi-bin/vpn.py ' -Xnull" when pasting.
I also tried disabling X-Frame-Options: "sameorigin"
and it made no difference (I knew it was a long shot)
Hostapd and lighttpd - manually download?
apt-get install *name of package*
When I type the same command apt-get install *name of package*
from which website that packages are downloaded? Is it possible to visit that site and download the zip folder?
If I download hostapd and lighttpd using web browser how I can install them.
Which websites should I use to download (there are many out there)?
What Are The Advantages of Using A Dedicated Web Server?
Install wordpress package always require apache?
apache|httpd
, lighttpd also provides httpd, but when I try to install WordPress, apt requires me to install apache2!
What I should do? I want to use only lighttpd !