Èíñòàëÿöèÿ è íàñòðîéêà lighttpd

Âîçíèêëà ïðîáëåìà ñ lighttpd...
Ñòîÿë ñåáå ðàáîòàë... íà íåì êðóòèëîñü ïàðó ñàéòîâ... + â êîíôèãå äëÿ îäíîãî ñàéòà áûëà íàñòðîåíà ïåðåàäðåñàöèÿ...
À â êàêîé-òî ìîìåíò âçÿë è ïåðåñòàë îòêðûâàòü ñàéòû è ïåðåàäðåñîâûâàòü...
â ëîãàõ ñèñòåìû íè÷åãî íå íàøåë
â access.log íè÷åãî íåò
â error.log òîëüêî ïðåäûäóùèå îñòàíîâêè è çàïóñêè ñåðâåðà...
ñàì ïðîöåññ lighttpd êðóòèòñÿ...

â ðó÷íîì ðåæèìå ïðîáîâàë îñòàíàâëèâàòü ñåðâèñ è çàïóñêàòü åãî çàíîãî - íèêàêèõ îøèáîê íå ãîâîðèò...

÷òî ìîæåò áûòü è ãäå êàïàòüñÿ?

Ïðîâåðÿòü íàäî äîñòóïû ê ïîðòàì, êîòîðûå èñïîëüçóåò Lighttpd

Quote:

---

Originally Posted by MFMan

Ïðîâåðÿòü íàäî äîñòóïû ê ïîðòàì, êîòîðûå èñïîëüçóåò Lighttpd

---

îí ðàáîòàåò íà 80 ïîðòó, êîòîðûé îòêðûò èçâíå, íî è èçíóòðè ñàéò òîæå íå îòêðûâàåòñÿ...

Quote:

---

Originally Posted by bocman

÷òî ìîæåò áûòü è ãäå êàïàòüñÿ?

---

ïîïðîáîâàòü îòêëþ÷èòü NFS èç ìîðäû.

---
MAD

òàê ÿ åãî íå âêëþ÷àë,
õîòÿ, êîíå÷íî õîòåë...

íè÷åãî íå ìåíÿë...

òàì æå â ìîðäå íà çàêëàäêå port forwarding íåò çàïèñåé?

ïîïðîáîâàòü ïîìåíÿòü â íàñòðîéêàõ ëàéòè ïîðò, åñëè ïîìîæåò, ñìîòðåòü ÷åì çàíÿò 80é.

---
MAD

Lighttpd.conf â ñòóäèþ!

Âîò îí:
îäíàêî õî÷ó åùå ðàç çàìåòèòü, ÷òî ñ òåõ ïîð, êàê îíî ðàáîòàëî ÿ åãî íå ìåíÿë...

Code:

---

# lighttpd configuration file
#
# use it as a base for lighttpd 1.0.0 and above
#
# $Id: lighttpd.conf 7711 2008-02-03 22:06:31Z oleo $

############ Options you really have to take care of ####################

## modules to load
# at least mod_access and mod_accesslog should be loaded
# all other module should only be loaded if really neccesary
# - saves some time
# - saves memory
server.modules              = (
                              "mod_rewrite",
                              "mod_redirect",
#                              "mod_alias",
                                "mod_access",
#                              "mod_cml",
#                              "mod_trigger_b4_dl",
                                "mod_auth",
#                              "mod_status",
#                              "mod_setenv",
                                "mod_fastcgi",
                              "mod_proxy",
                                "mod_simple_vhost",
#                              "mod_evhost",
#                              "mod_userdir",
                                "mod_cgi",
#                              "mod_compress",
#                              "mod_ssi",
#                              "mod_usertrack",
#                              "mod_expire",
#                              "mod_secdownload",
#                              "mod_rrdtool",
                                "mod_accesslog" )

## a static document-root, for virtual-hosting take look at the
## server.virtual-* options
server.document-root        = "/opt/share/www/"

## where to send error-messages to
server.errorlog            = "/opt/var/log/lighttpd/error.log"

# files to check for if .../ is requested
index-file.names            = ( "index.php", "index.html",
                                "index.htm", "index.php3",
                                "default.htm",        "transmission.cgi" )

## set the event-handler (read the performance section in the manual)
# server.event-handler = "freebsd-kqueue" # needed on OS X

# mimetype mapping
mimetype.assign            = (
  ".pdf"          =>      "application/pdf",
  ".sig"          =>      "application/pgp-signature",
  ".spl"          =>      "application/futuresplash",
  ".class"        =>      "application/octet-stream",
  ".ps"          =>      "application/postscript",
  ".torrent"      =>      "application/x-bittorrent",
  ".dvi"          =>      "application/x-dvi",
  ".gz"          =>      "application/x-gzip",
  ".pac"          =>      "application/x-ns-proxy-autoconfig",
  ".swf"          =>      "application/x-shockwave-flash",
  ".tar.gz"      =>      "application/x-tgz",
  ".tgz"          =>      "application/x-tgz",
  ".tar"          =>      "application/x-tar",
  ".zip"          =>      "application/zip",
  ".mp3"          =>      "audio/mpeg",
  ".m3u"          =>      "audio/x-mpegurl",
  ".wma"          =>      "audio/x-ms-wma",
  ".wax"          =>      "audio/x-ms-wax",
  ".ogg"          =>      "application/ogg",
  ".wav"          =>      "audio/x-wav",
  ".gif"          =>      "image/gif",
  ".jpg"          =>      "image/jpeg",
  ".jpeg"        =>      "image/jpeg",
  ".png"          =>      "image/png",
  ".xbm"          =>      "image/x-xbitmap",
  ".xpm"          =>      "image/x-xpixmap",
  ".xwd"          =>      "image/x-xwindowdump",
  ".css"          =>      "text/css",
  ".html"        =>      "text/html",
  ".htm"          =>      "text/html",
  ".js"          =>      "text/javascript",
  ".asc"          =>      "text/plain",
  ".c"            =>      "text/plain",
  ".cpp"          =>      "text/plain",
  ".log"          =>      "text/plain",
  ".conf"        =>      "text/plain",
  ".text"        =>      "text/plain",
  ".txt"          =>      "text/plain",
  ".dtd"          =>      "text/xml",
  ".xml"          =>      "text/xml",
  ".mpeg"        =>      "video/mpeg",
  ".mpg"          =>      "video/mpeg",
  ".mov"          =>      "video/quicktime",
  ".qt"          =>      "video/quicktime",
  ".avi"          =>      "video/x-msvideo",
  ".asf"          =>      "video/x-ms-asf",
  ".asx"          =>      "video/x-ms-asf",
  ".wmv"          =>      "video/x-ms-wmv",
  ".bz2"          =>      "application/x-bzip",
  ".tbz"          =>      "application/x-bzip-compressed-tar",
  ".tar.bz2"      =>      "application/x-bzip-compressed-tar"
 )

# Use the "Content-Type" extended attribute to obtain mime type if possible
#mimetype.use-xattr        = "enable"


## send a different Server: header
## be nice and keep it at lighttpd
# server.tag                = "lighttpd"

#### accesslog module
accesslog.filename          = "/opt/var/log/lighttpd/access.log"

## deny access the file-extensions
#
# ~    is for backupfiles from vi, emacs, joe, ...
# .inc is often used for code includes which should in general not be part
#      of the document-root
url.access-deny            = ( "~", ".inc" )

$HTTP["url"] =~ "\.pdf$" {
  server.range-requests = "disable"
}

##
# which extensions should not be handle via static-file transfer
#
# .php, .pl, .fcgi are most often handled by mod_fastcgi or mod_cgi
static-file.exclude-extensions = ( ".fcgi", ".php", ".pl", ".py", ".rb", ".php3" )

######### Options that are good to be but not neccesary to be changed #######

## bind to port (default: 80)
server.port                = 80

## bind to localhost (default: all interfaces)
#server.bind                = "grisu.home.kneschke.de"

## error-handler for status 404
server.error-handler-404  = "/404.html"
#server.error-handler-404  = "/error-handler.php"

## to help the rc.scripts
server.pid-file            = "/var/run/lighttpd.pid"


###### virtual hosts
##
##  If you want name-based virtual hosting add the next three settings and load
##  mod_simple_vhost
##
## document-root =
##  virtual-server-root + virtual-server-default-host + virtual-server-docroot
## or
##  virtual-server-root + http-host + virtual-server-docroot
##
#simple-vhost.server-root  = "/home/weigon/wwwroot/servers/"
#simple-vhost.default-host  = "grisu.home.kneschke.de"
#simple-vhost.document-root = "/pages/"

simple-vhost.server-root = "/opt/share/www/"
simple-vhost.default-host = "www.mydomain.com"

$HTTP["host"] == "mydomain.com" {
    server.document-root = "/otp/share/www/www.mydomain.com/"
}

---

ïðîäîëæåíèå

Code:

---


##
## Format: <errorfile-prefix><status-code>.html
## -> ..../status-404.html for 'File not found'
#server.errorfile-prefix    = "/home/weigon/projects/lighttpd/doc/status-"

## virtual directory listings
## ýòî ÷òîáû ìîæíî áûëî ëèñòàòü äèðåêòîðèè, íå ñîäåðæàùèå index.* è ò.ï.
## Ò.å. òàêèì îáðàçîì ìîæíî áóäåò ýëåìåíòàðíî ñêà÷èâàòü ôàéëû ñ ðîóòåðà ïî http.
## Íåîáõîäèìî äëÿ òîððåíòà transmission.
dir-listing.activate      = "enable"
dir-listing.encoding = "cp1251"

## enable debugging
#debug.log-request-header  = "enable"
#debug.log-response-header  = "enable"
#debug.log-request-handling = "enable"
#debug.log-file-not-found  = "enable"

### only root can use these options
#
# chroot() to directory (default: no chroot() )
#server.chroot              = "/"

## change uid to <uid> (default: don't care)
#server.username            = "nobody"

## change uid to <uid> (default: don't care)
#server.groupname          = "nobody"

#### compress module
#compress.cache-dir        = "/tmp/lighttpd/cache/compress/"
#compress.filetype          = ("text/plain", "text/html")

#### proxy module
## read proxy.txt for more info
#proxy.server              = ( ".php" =>
#                              ( "localhost" =>
#                                (
#                                  "host" => "192.168.0.101",
#                                  "port" => 80
#                                )
#                              )
#                            )

#### fastcgi module
## read fastcgi.txt for more info
fastcgi.server            = ( ".php" =>
                              ( "localhost" =>
                                (
                                  "min-procs" => 1,
                                  "max-procs" => 1,
                                  "max-load-per-proc" => 4,
                                  "socket" => "/tmp/php-fastcgi.socket",
                                  "bin-path" => "/opt/bin/php-fcgi"
                                  )
                                )
                              )

#### CGI module
cgi.assign                = ( ".pl"  => "/opt/bin/microperl",
                              ".cgi" => "/opt/bin/microperl" )


#### SSL engine
#ssl.engine                = "enable"
#ssl.pemfile                = "server.pem"

#### status module
#status.status-url          = "/server-status"
#status.config-url          = "/server-config"

#### auth module
auth.debug = 0

## read authentication.txt for more info
#auth.backend              = "plain"
#auth.backend.plain.userfile = "lighttpd.user"
#auth.backend.plain.groupfile = "lighttpd.group"

#auth.backend.ldap.hostname = "localhost"
#auth.backend.ldap.base-dn  = "dc=my-domain,dc=com"
#auth.backend.ldap.filter  = "(uid=$)"

#auth.require              = ( "/server-status" =>
#                              (
#                                "method"  => "digest",
#                                "realm"  => "download archiv",
#                                "require" => "user=jan"
#                              ),
#                              "/server-config" =>
#                              (
#                                "method"  => "digest",
#                                "realm"  => "download archiv",
#                                "require" => "valid-user"
#                              )
#                            )

#auth.backend = "htpasswd"
#auth.backend.htpasswd.userfile = "/opt/share/www/.webuser_pass"

auth.backend = "htdigest"
auth.backend.htdigest.userfile = "/opt/share/www/.webuser_pass"
auth.require = ( "/stuff/" =>
                (
                    "method"  => "digest",
                    "realm"    => "Need Authorization",
                    "require"  => "valid-user"
                ),
                "/upload/" =>
                (
                    "method"  => "digest",
                    "realm"    => "Need Authorization",
                    "require"  => "valid-user"
                )
              )


#### url handling modules (rewrite, redirect, access)
#url.rewrite                = ( "^/$"            => "/server-status" )
#url.redirect              = ( "^/wishlist/(.+)" => "http://www.123.org/$1" )
#### both rewrite/redirect support back reference to regex conditional using %n
#$HTTP["host"] =~ "^www\.(.*)" {
#  url.redirect            = ( "^/(.*)" => "http://%1/$1" )
#}

$HTTP["host"] == "nas.mydomain.com" {
    proxy.server = ( "" => ( "" => ( "host" => "192.168.0.2", "port" => 80)))
}


#
# define a pattern for the host url finding
# %% => % sign
# %0 => domain name + tld
# %1 => tld
# %2 => domain name without tld
# %3 => subdomain 1 name
# %4 => subdomain 2 name
#
#evhost.path-pattern        = "/home/storage/dev/www/%3/htdocs/"

#### expire module
#expire.url                = ( "/buggy/" => "access 2 hours", "/asdhas/" => "access plus 1 seconds 2 minutes")

#### ssi
#ssi.extension              = ( ".shtml" )

#### rrdtool
#rrdtool.binary            = "/opt/bin/rrdtool"
#rrdtool.db-name            = "/var/www/lighttpd.rrd"

#### setenv
#setenv.add-request-header  = ( "TRAV_ENV" => "mysql://user@host/db" )
#setenv.add-response-header = ( "X-Secret-Message" => "42" )

## for mod_trigger_b4_dl
# trigger-before-download.gdbm-filename = "/home/weigon/testbase/trigger.db"
# trigger-before-download.memcache-hosts = ( "127.0.0.1:11211" )
# trigger-before-download.trigger-url = "^/trigger/"
# trigger-before-download.download-url = "^/download/"
# trigger-before-download.deny-url = "http://127.0.0.1/index.html"
# trigger-before-download.trigger-timeout = 10

## for mod_cml
## don't forget to add index.cml to server.indexfiles
# cml.extension              = ".cml"
# cml.memcache-hosts          = ( "127.0.0.1:11211" )

#### variable usage:
## variable name without "." is auto prefixed by "var." and becomes "var.bar"
#bar = 1
#var.mystring = "foo"

## integer add
#bar += 1
## string concat, with integer cast as string, result: "www.foo1.com"
#server.name = "www." + mystring + var.bar + ".com"
## array merge
#index-file.names = (foo + ".php") + index-file.names
#index-file.names += (foo + ".php")

#### include
#include /etc/lighttpd/lighttpd-inc.conf
## same as above if you run: "lighttpd -f /etc/lighttpd/lighttpd.conf"
#include "lighttpd-inc.conf"

#### include_shell
#include_shell "echo var.a=1"
## the above is same as:
#var.a=1


$HTTP["host"] == "my.mydomain.com" {
  include "dokuwiki.conf"
  }

---

Âñ¸ â êîíôèãå âðîäå íîðìàëüíî.
Ïîïðîáóé çàáýêàïèòü âñå íàñòðîéêè, ñíåñòè ñ óäàëåíèåì íàñòðîåê è ïîíóëÿì çàïóñòèòü, åñëè çàïóñòèòñÿ, òî ïîáëåìà â íàñòðîéêàõ, åñëè íåò òî ñ iptables. Ñàì òàê è âû÷èñëÿë íåñêîëüêî ðàç.

ïðåóñòàíîâêà lighttpd äàëà ñâîè ïëîäû - èç ëîêàëè è ïî ip ñàéò íà÷àë îòêðûâàòüñÿ... à âîò ñàéòû ïî äîìåííîìó èìåíè (â ò.÷. è òðåòüåãî óðîâíÿ) íå îòêðûâàþòñÿ...
èçâíå òîæå íè÷åãî íåîòêðûâàåòñÿ (êàê ïî äîìåííîìó èìåíè, òàê è ïî âíåøíåìó ip)

ãëÿíüòå ìîé post-firewall ìîæåò, êòî-íèáóòü ÷òî-íèáóäü â íåì çàìåòèò...

Code:

---

#!/bin/sh
iptables -P INPUT DROP
iptables -D INPUT -j DROP
iptables -A INPUT -p tcp --syn --dport 443 -j ACCEPT

# Openning port to ftp-server on WL500gP (vsftpd)
iptables -A INPUT -p tcp --dport 221 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -p tcp --dport 65534 -j ACCEPT

# port-forvarding to ADMIN web-server on NAS
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 8081 -j DNAT --to-destinati
on 192.168.0.2:80
iptables -I FORWARD -i ppp0 -p tcp -m tcp -d 192.168.0.2 --dport 80 -j ACCEPT
iptables -I FORWARD -o ppp0 -p tcp -m tcp -s 192.168.0.2 --sport 80 -j ACCEPT
iptables -t nat -A POSTROUTING -p tcp -o ppp0 -s 192.168.0.2 --sport 80 -j SNAT
--to-source <ìîé âíåøíèé ip>
# end of port-forwarding to ADMIN  web-server on NAS

# port-forvarding to web-server on NAS
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 8082 -j DNAT --to-destinati
on 192.168.0.2:8082
iptables -I FORWARD -i ppp0 -p tcp -m tcp -d 192.168.0.2 --dport 8082 -j ACCEPT
iptables -I FORWARD -o ppp0 -p tcp -m tcp -s 192.168.0.2 --sport 8082 -j ACCEPT
iptables -t nat -A POSTROUTING -p tcp -o ppp0 -s 192.168.0.2 --sport 8082 -j SNA
T --to-source <ìîé âíåøíèé ip>
# end of port-forwarding to admin  web-server on NAS

# port-forvarding to ftp-server on NAS
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 21 -j DNAT --to-destination
 192.168.0.2:21
iptables -I FORWARD -i ppp0 -p tcp -m tcp -d 192.168.0.2 --dport 21 -j ACCEPT
iptables -I FORWARD -o ppp0 -p tcp -m tcp -s 192.168.0.2 --sport 21 -j ACCEPT
iptables -t nat -A POSTROUTING -p tcp -o ppp0 -s 192.168.0.2 --sport 21 -j SNAT
--to-source <ìîé âíåøíèé ip>
# end of port-forwarding to ftp-server on NAS

# port-forvarding to torrent on NAS
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 9090 -j DNAT --to-destinati
on 192.168.0.2:9090
iptables -I FORWARD -i ppp0 -p tcp -m tcp -d 192.168.0.2 --dport 9090 -j ACCEPT
iptables -I FORWARD -o ppp0 -p tcp -m tcp -s 192.168.0.2 --sport 9090 -j ACCEPT
iptables -t nat -A POSTROUTING -p tcp -o ppp0 -s 192.168.0.2 --sport 9090 -j SNA
T --to-source <ìîé âíåøíèé ip>

iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 9089 -j DNAT --to-destinati
on 192.168.0.2:9089
iptables -I FORWARD -i ppp0 -p tcp -m tcp -d 192.168.0.2 --dport 9090 -j ACCEPT
iptables -I FORWARD -o ppp0 -p tcp -m tcp -s 192.168.0.2 --sport 9090 -j ACCEPT
iptables -t nat -A POSTROUTING -p tcp -o ppp0 -s 192.168.0.2 --sport 9089 -j SNA
T --to-source <ìîé âíåøíèé ip>
# end of port-forwarding to torrent on NAS

# port-forvarding for RDP
iptables -t nat -I PREROUTING -i ppp0 -p tcp -d <ìîé âíåøíèé ip> --dport 3389 -j D
NAT --to-destination 192.168.0.101:3389
iptables -t nat -I PREROUTING -o ppp0 -p tcp -s 192.168.0.101 --sport 3389 -j DN
AT --to-destination <ìîé âíåøíèé ip>
iptables -I FORWARD -i ppp0 -p tcp -m tcp -d 192.168.0.101 --dport 3389 -j ACCEP
T
iptables -I FORWARD -o ppp0 -p tcp -m tcp -s 192.168.0.101 --sport 3389 -j ACCEP
T

#iptables -t nat -I PREROUTING -i ppp0 -p tcp -d <ìîé âíåøíèé ip> -s $WORK_IP --dp
ort 3389 -j DNAT --to-destination 192.168.0.101:3389
#end of port-forvarding for RDP


iptables -A INPUT -j DROP

---

Ïîïðîáóé îáíóëèòü post-firewall(òîêà ñîõðàíè;)) è ïðîïèñàòü ïðîáðîñ â Virtual Server â âåá-ìîðäå ðîóòåðà

ïî÷èñòèë post-farewall - íå ïîìîãëî

netstat -nl ãîâîðèò:

Code:

---

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address          Foreign Address        State
tcp        0      0 0.0.0.0:515            0.0.0.0:*              LISTEN
tcp        0      0 192.168.0.1:139        0.0.0.0:*              LISTEN
tcp        0      0 0.0.0.0:9100            0.0.0.0:*              LISTEN
tcp        0      0 0.0.0.0:80              0.0.0.0:*              LISTEN
tcp        0      0 0.0.0.0:8080            0.0.0.0:*              LISTEN
tcp        0      0 0.0.0.0:53              0.0.0.0:*              LISTEN
tcp        0      0 0.0.0.0:5431            0.0.0.0:*              LISTEN
tcp        0      0 0.0.0.0:3838            0.0.0.0:*              LISTEN
tcp        0      0 :::23                  :::*                    LISTEN
tcp        0      0 :::443                  :::*                    LISTEN
udp        0      0 0.0.0.0:1024            0.0.0.0:*
udp        0      0 127.0.0.1:1030          0.0.0.0:*
udp        0      0 192.168.0.1:137        0.0.0.0:*
udp        0      0 0.0.0.0:137            0.0.0.0:*
udp        0      0 192.168.0.1:138        0.0.0.0:*
udp        0      0 0.0.0.0:138            0.0.0.0:*
udp        0      0 127.0.0.1:34954        0.0.0.0:*
udp        0      0 0.0.0.0:9999            0.0.0.0:*
udp        0      0 0.0.0.0:53              0.0.0.0:*
udp        0      0 0.0.0.0:67              0.0.0.0:*
udp        0      0 0.0.0.0:1900            0.0.0.0:*
raw        0      0 0.0.0.0:1              0.0.0.0:*              0
raw        0      0 0.0.0.0:2              0.0.0.0:*              0
raw        0      0 0.0.0.0:255            0.0.0.0:*              0
Active UNIX domain sockets (only servers)
Proto RefCnt Flags      Type      State        I-Node Path
unix  2      [ ACC ]    STREAM    LISTENING    1299  /tmp/php-fastcgi.socket-0
unix  2      [ ACC ]    STREAM    LISTENING    654    /var/run/pptp/255.255.255.255:10.10.9.14

---

÷òî çíà÷èò "0.0.0.0:80"? ÷åì ýòî îòëè÷àåòñÿ, íàïðèìåð îò ":::80" èëè îò "127.0.0.0:80" ?

êàê ïîñìîòðåòü êàêîå èìåííî ïðèëîæåíèå ïðîñëóøèâàåò ïîðò?

Ìîæíî ëè îðãàíèçîâàòü ãðóïïîâóþ àâòîðèçàöèþ?
Ïðîáîâàë äåëàòü:

Code:

---

auth.require = ( "/vnstat/" =>
                (
                "method"  => "basic",
                "realm"    => "Need Authorization",
                "require"  => "group=some_users"
                ),

---

 ðåçóëüòàòå â ëîãå:

Code:

---

group ... (not implemented)

---

.
Ïðîáîâàë

Code:

---

"require"  => "user=user1:user=user2"

---

- äàæå ýòî íå ïðîêàòûâàåò.
Åñòü ëè êàêèå-íèáóäü âîçìîæíîñòè (æåëàòåëüíî êîíå÷íî ïî-÷åëîâå÷åñêè, ÷åðåç ôàéë ãðóïï) ïðèêðóòèòü ãðóïïîâóþ àâòîðèçàöèþ?

Quote:

---

Originally Posted by dimm33

Íåìíîãî ïåðåìóäðèë ñ lighttpd.conf. Ó êîãî-íèáóäü ñîõðàíèëñÿ äåôîëòíûé ôàéë? Ïðèêðåïèòå, ïîæàëóéñòà.

---

Âîò åñòü ñòàíäàðòíûé ôàéë.