Lighttpd - Httqm's Docs

List all addresses inline :

$HTTP["remoteip"] !~ "12\.34\.56\.78|34\.56\.78\.90" {
	url.access-deny = ( "" )
	}

Use a variable :

var.allowedIpAddresses = "127\.0\.0\.1|"
var.allowedIpAddresses += "12\.34\.56\.78|"		# Bob
var.allowedIpAddresses += "34\.56\.78\.90|"		# Kevin
var.allowedIpAddresses += "56\.78\.90\.12"		# Stuart

$HTTP["remoteip"] !~ allowedIpAddresses {
	url.access-deny = ( "" )
	}

Both methods are functionally identical and only differ in readability. Just don't forget :

escape the dot characters (.) in IP addresses to explicitly match dots rather than any single character
the inline list or allowedIpAddresses MUST NOT have a trailing pipe character (|), otherwise the empty string following it will match any IP address, then whitelisting everybody (i.e. filtering nothing).

Lighttpd has no AND / OR logical operators, but it's possible to obtain the same behavior by nesting / chaining conditions.

Logical AND :

condition1 {
	condition2 {
		doSomething
		}
	}

nested if blocks are equivalent to a logical AND

Logical OR :

condition1 {
	doSomething
	}
condition2 {
	doSomething
	}

chained if blocks are equivalent to a logical OR

`if-then-elif-else` construct :

condition1 {
	doSomething1	then block
	}
else condition2 {
	doSomething2	else if block
	}
else {
	doSomething3	else block
	}

The procedure below works better when Lighttpd is directly facing HTTP clients. If there is an extra layer (web cache, load balancing, ...) :

depending on whether the HTTP requests reach Lighttpd altered or not, you may not have enough information to chose what to serve :
- the requested resource
- OR a "do not hotlink" resource
if the response returned by Lighttpd is not built so that it's a single-usage answer, it may itself be cached by your web cache, meaning the next resembling request may not even reach Lighttpd (generally leading to over-blocking)
testing things (with web cache + browser cache) will give you headaches (especially if you rewrite rather than redirect requests)
it is simpler + more efficient to filter directly from the extra client-facing layer

open /etc/lighttpd/lighttpd.conf

add something like (source) :

$HTTP["referer"] =~ "BADDOMAIN\.com|IMAGESUCKERDOMAIN\.com" {
	url.rewrite = ("(?i)(/.*\.(jpe?g|png))$" => "/path/to/hotlink.png" )
	}

On my side, since I already configured caches for the images, I had :

$HTTP["url"] =~ "(gif|jpg|png|svg)$" {
	expire.url = ( "" => "access plus 1 weeks" ),
	setenv.add-response-header = ( "Cache-Control" => "public, max-age=604800" )
	}

which becomes :

$HTTP["url"] =~ "(gif|jpg|png|svg)$" {
	$HTTP["referer"] =~ "BADDOMAIN\.com|IMAGESUCKERDOMAIN\.com" {
		url.rewrite = ("(?i)(/.*\.(gif|jpe?g|png|svg))$" => "pictures/hotlinking.png" )
		}

	expire.url = ( "" => "access plus 1 weeks" ),
	setenv.add-response-header = ( "Cache-Control" => "public, max-age=604800" )
	}

This works on a blacklisting principle, meaning only the pages from the listed domains will actually be affected. This also implies analyzing the webserver logs in search of such hotlinkers. So far, I've not found any better solution .

Details about making conditional configuration with logical AND / OR / if-then-elif-else rules

check the syntax of the configuration file
restart Lighttpd :
systemctl restart lighttpd.service
restart / purge web caches, if any
check it :
- make a "legal" request :
  wget -S -O /dev/null http://your.domain.tld/whatever.jpg
  you should get an HTTP 200 + the requested whatever.jpg
- simulate a request from a hotlinking page :
  wget -S -O /dev/null --header "Referer: BADDOMAIN.com" http://your.domain.tld/whatever.jpg
  you should get the pictures/hotlinking.png
That's it. Enjoy

Some webservers may expose content publicly, which is not always desirable. Several solutions exist to workaround this :

develop (or install an existing solution —if this exists) that will serve any specific URL only after providing the right credentials
or completely leave this task to the webserver itself. This is what this article is about, focusing on the Lighttpd web server.

As a non-security expert, I can NOT ensure what follows is safe / good practice / well implemented. Use at your own risk.
While reading on this topic, I've found blogs / articles stating that this is buggy in Lighttpd (not perfectly standard-compliant / has some bugs)...

Read : What's the difference between Basic and Digest authentication ?

The basic method :

Create the password file :
htpasswd -c /path/to/.htpasswd kevin
```
New password: PaSsWoRd
Re-type new password: PaSsWoRd
Adding password for user kevin
```
There are no strong restrictions regarding /path/to/.htpasswd (location or name (.htpasswd is just an example)), but :
- it shouldn't be stored anywhere under the document root of the corresponding website / virtualhost : it might be disclosed in the event of a web server misconfiguration
- don't forget to make it readable by the user executing Lighttpd

Configure Lighttpd :

server modules :
```
server.modules = (
	
	"mod_auth",
	
	)
```
mod_auth must be loaded before mod_fastcgi (source).

virtualhost (details) :

$HTTP["host"] =~ "" {
	
	auth.backend = "htpasswd"
	auth.backend.htpasswd.userfile = "/path/to/.htpasswd"
	auth.require = ( "/url/to/protect" => (		this is what comes after "http://www.example.com/"
			"method"  => "basic",
			"realm"   => "prompt",		will be displayed on the login/password pop-up window
			"require" => "valid-user"	valid-user to allow any valid user, or a list of |-separated user=username
			)
		)
	
	}

Check the syntax of the configuration file
restart Lighttpd :
systemctl restart lighttpd.service

Test it with

a web browser

a command line tool such as wget :

wget -S -O /dev/null http://www.example.com/url/to/protect

HTTP request sent, awaiting response...
	HTTP/1.1 401 Unauthorized
	WWW-Authenticate: Basic realm="prompt", charset="UTF-8"
	Content-Type: text/html
	

Username/Password Authentication Failed.

wget -S -O /dev/null --http-user=bob --http-password=PaSsWoRd http://www.example.com/url/to/protect

HTTP request sent, awaiting response...
	HTTP/1.1 401 Unauthorized
	WWW-Authenticate: Basic realm="prompt", charset="UTF-8"
	Content-Type: text/html
	
Authentication selected: Basic realm="prompt", charset="UTF-8"
Reusing existing connection to www.example.com:80.
HTTP request sent, awaiting response...
	HTTP/1.1 200 OK
	Content-type: text/html; charset=utf-8

The digest method (source) :

Create the password file :
htdigest -c /path/to/.htdigest 'prompt' kevin
```
Adding password for kevin in realm prompt.
New password: PaSsWoRd
Re-type new password: PaSsWoRd
```
Same remark as above regarding the password file.

Check it :

cat /path/to/.htdigest

kevin:prompt:222b05e09cf0635131ab4f0a44bd5d59

Configure Lighttpd :

server modules :
```
server.modules = (
	
	"mod_auth",
	
	)
```
mod_auth must be loaded before mod_fastcgi (source).

virtualhost (details) :

$HTTP["host"] =~ "" {
	
	auth.backend = "htdigest"
	auth.backend.htdigest.userfile = "/path/to/.htdigest"
	auth.require = ( "/url/to/protect" => (		this is what comes after "http://www.example.com/"
			"method"  => "digest",
			"realm"   => "prompt",		will be displayed on the login/password pop-up window
			"require" => "valid-user"	valid-user to allow any valid user, or a list of |-separated user=username
			)
		)
	
	}

The construct in the snippet above applies when :

the corresponding virtualhost has both public (i.e. passwordless) and private (password-protected) URLs
there is a known and limited set of private URLs (example)

If all URLs are private, you may use :

$HTTP["host"] =~ "" {
	server.document-root    = "/var/www/myVirtualhost"
	accesslog.filename      = "/var/log/myVirtualhost.log"

	$HTTP["url"] =~ "^/" {		match everything
		auth.backend = "htdigest"
		auth.backend.htdigest.userfile = "/path/to/.htdigest"
		auth.require = ( "" => (			empty string, on purpose
				"method"  => "digest",
				"realm"   => "prompt",
				"require" => "valid-user"
				)
			)
		}
	}

Check the syntax of the configuration file
restart Lighttpd :
systemctl restart lighttpd.service

Test it with wget :

wget -S -O /dev/null http://www.example.com/url/to/protect

HTTP request sent, awaiting response...
	HTTP/1.1 401 Unauthorized
	WWW-Authenticate: Digest realm="prompt", charset="UTF-8", nonce="5bf7111e:b193aaf497484f867e4c02793a0ff9fd", qop="auth"
	Content-Type: text/html
	

Username/Password Authentication Failed.

wget -S -O /dev/null --http-user=bob --http-password=PaSsWoRd http://www.example.com/url/to/protect

HTTP request sent, awaiting response...
	HTTP/1.1 401 Unauthorized
	WWW-Authenticate: Digest realm="prompt", charset="UTF-8", nonce="5bf7120c:89e30ae25bad5914828b14a0d99319f7", qop="auth"
	Content-Type: text/html
	
Authentication selected: Digest realm="prompt", charset="UTF-8", nonce="5bf7120c:89e30ae25bad5914828b14a0d99319f7", qop="auth"
Reusing existing connection to www.example.com:80.
HTTP request sent, awaiting response...
	HTTP/1.1 200 OK
	Content-type: text/html; charset=utf-8

lighttpd -tt -f /etc/lighttpd/lighttpd.conf

will output :

nothing if no error is detected
or a message describing the reason of its frustration (and possibly the line of the configuration file where bad things began)

Flag	Usage
-f configurationFile	Load file configurationFile
-t	test the configuration file for syntax errors and exit
-tt	Test the configuration file for syntax errors, load and initialize modules, and exit this mode may be over-pernickety —especially while the daemon is running— reporting that modules can not be loaded twice. Try with -t

Let's say you have a single page website (http://www.mysite.tld), and you want ALL requests (whatever they are) to be "sent" to that unique page. It is tempting to create a rule for anything not matching /index.html, and effectively redirect to that URL.

Actually, when I tried to do so, I've not been able to make it work : the /whatever requests were effectively redirected to /index.html, matched again and looped . I don't know if it's even possible to redirect rather than rewrite.

The magic is rewriting instead of redirecting, with a rule such as :

url.rewrite-once = ( "^/(.*)" => "/index.html" )

We're configuring redirects / rewrites, which is done with Regular Expressions and nothing much exotic so far... until we want to create a rule for requests not matching a RegExp.

Lighttpd has its own syntax to do so :

(?!expression)

expression itself can also have some ( ), be careful .

Add Expires headers (source) :

Load the mod_expire module :

server.modules = (
	,
	"mod_expire",
	
	)

Define per-URL rules :

$HTTP["url"] =~ "html$" {
	expire.url = ( "" => "access plus 15 minutes" )
	}

$HTTP["url"] =~ "(gif|jpg|png)$" {
	expire.url = ( "" => "access plus 2 hours" )
	}

Don't forget to define a rule for the home page :

$HTTP["url"] =~ "^/$" {  }

Reload. Validate changes with Firebug or wget. Enjoy.

Add Cache-Control headers :

Load the mod_setenv module :
```
server.modules += ( "mod_setenv" )
```

Define rules :

server-wide :

setenv.add-response-header += (
	"Cache-Control" => "public, max-age=86400"
	)

per URL :

$HTTP["url"] =~ "^/$" {
	setenv.add-response-header = ( "Cache-Control" => "public, max-age=86400" )
	}

check the syntax of the configuration file
Reload :
systemctl restart lighttpd.service
Validate changes with Firebug or wget. Enjoy.

Make sure the configuration includes mod_redirect :

server.modules = (
	,
	"mod_redirect",
	
	)

Then edit the corresponding virtualhost :
```
$HTTP["host"] =~ "^(my\.site\.tld)" {
	server.document-root	= "/var/www/my.site.tld"
	
	url.redirect = (
		"^/(.*)\.xml$"	=>	"http://%1/$1.html"
		)
	}
```
$n

the substring that was matched by the n^th (regExp) from the current regexp match (i.e. the url.redirect directive). Here $1 matches "document" (since the HTTP request is for /document.xml).

%n

the substring that was matched by the n^th (regExp) from the previous regexp match (i.e. the $HTTP["host"] directive). Here %1 matches "my.site.tld".
By default, url.redirect returns a 301 HTTP status. You can specify another status with :
```
	url.redirect-code = 302
```
Check your configuration
Reload the configuration and voilà !

Enable compression (source : 1, 2)
Disable the server signature

Debug rewrite rules and other stuff (sources : 1, 2) :

Edit etc/lighttpd/lighttpd.conf :

server.errorlog			= "/var/log/lighttpd/error.log"
debug.log-condition-handling	= "enable"	# nice but VERY verbose
debug.log-response-header	= "enable"
debug.log-request-handling	= "enable"

The logs complain WARNING: unknown config-key: accesslog.filename :

Looks like an expected server module has not been declared (hence not loaded) but is expected in the configuration. To fix this :

Have a look at the available server modules and find the one matching the error message : accesslog.filename sounds related to mod_accesslog, isn't it ?

Edit the configuration (either /etc/lighttpd/lighttpd.conf or any other file) :

```
server.modules += ( "mod_accesslog" )
```

server.modules = (
	...
	"mod_setenv",
	"mod_accesslog",
	...
	)

Create the self-signed certificate :

siteName='example.com'; lighttpdCertificateFolder="/etc/lighttpd/ssl/$siteName"; lighttpdUser='userName'; lighttpdGroup='groupName'
mkdir -p $lighttpdCertificateFolder; cd $lighttpdCertificateFolder
openssl req -new -x509 -keyout $siteName.pem -out $siteName.pem -days 365 -nodes
At prompt "Common Name (eg, YOUR name) []:", enter the domain name that will be served through SSL. This can be the "$siteName" or *.example.com
chown ${lighttpdUser}:${lighttpdGroup} /etc/lighttpd/ssl -R
chmod 0600 /etc/lighttpd/ssl/$siteName

Configure Lighttpd :

documentRootFolder='/var/www/ssl'; mkdir -p $documentRootFolder; echo "HTTPS: HELLO WORLD" > $documentRootFolder/index.html
cp /etc/lighttpd/lighttpd.conf{,_BITI}; vim /etc/lighttpd/lighttpd.conf

# TESTING (SSL)
$SERVER["socket"] == "192.168.144.114:443" {
	server.document-root = "/var/www/ssl"
	ssl.engine = "enable"
	ssl.pemfile = "/etc/lighttpd/ssl/example.com/example.com.pem"
	}
# /TESTING (SSL)

Then, open in a browser : https://192.168.144.114/
Enjoy !

General information on sites served via SSL/TLS :

A web page such as http://www.example.com/index.php can legally link some resources from a different domain such as http://static.example.com/style.css. As far as HTTPS is concerned, if https://www.example.com/index.php links http://static.example.com/style.css, this is called mixed content and it's blocked by Firefox and other browsers.

Lighttpd - fly light.

How to whitelist IP addresses ?

Lighttpd conditional configuration

Logical AND :

Logical OR :

`if-then-elif-else` construct :

How to defeat hotlinking with Lighttpd ?

How to password-protect a subtree of a website ?

Situation

Solution

The basic method :

The digest method (source) :

How to check the syntax of the configuration file ?

Usage

Flags

How to send all requests to a single URL ?

Situation

Details

Solution

How to make a negative match in a RegExp for mod_redirect or mod_rewrite ?

Situation

Solution

How to configure caches ?

Add Expires headers (source) :

Add Cache-Control headers :

How to redirect requests made to my.site.tld/document.xml to my.site.tld/document.html ?

Lighttpd config tips

Debug rewrite rules and other stuff (sources : 1, 2) :

The logs complain WARNING: unknown config-key: accesslog.filename :

Create and install a self-signed SSL certificate

Create the self-signed certificate :

Configure Lighttpd :

General information on sites served via SSL/TLS :

How to whitelist IP addresses ?

Lighttpd conditional configuration

Logical AND :

Logical OR :

if-then-elif-else construct :

How to defeat hotlinking with Lighttpd ?

How to password-protect a subtree of a website ?

Situation

Solution

The basic method :

The digest method (source) :

How to check the syntax of the configuration file ?

Usage

Flags

How to send all requests to a single URL ?

Situation

Details

Solution

How to make a negative match in a RegExp for mod_redirect or mod_rewrite ?

Situation

Solution

How to configure caches ?

Add Expires headers (source) :

Add Cache-Control headers :

How to redirect requests made to my.site.tld/document.xml to my.site.tld/document.html ?

Lighttpd config tips

Debug rewrite rules and other stuff (sources : 1, 2) :

The logs complain WARNING: unknown config-key: accesslog.filename :

Create and install a self-signed SSL certificate

Create the self-signed certificate :

Configure Lighttpd :

General information on sites served via SSL/TLS :

`if-then-elif-else` construct :