Äîñòóï ê lighttpd ñ ssl òîëüêî ïî ñåðòèôèêàòàì

**egorart** · 24-12-2011, 21:01

çäðàâñòâóéòå. ïðîáëåìà âîò êàêàÿ
ïûòàþñü ñäåëàòü lighttpd + ssl + àâòîðèçàöèÿ íà ïàïêó rutorrent ïî ïàðîëþ
âðîäå âñå ñäåëàë ïî èíñòðóêöèè, íî ïðè çàõîäå ïî ññûëêå https://172.16.0.254/rutorrent lighttpd "çàâèñàåò"
ò.å. äî òîãî êàê çàéòè ïî ññûëêå ñåðâåð ðàáîòàåò è îòäàåò ñòðàíèöû ïîñëå çàõîäà ñåðâåð íå îòâå÷àåò
â ëîãàõ ïóñòî (ò.å. ïðîñòî ñîîáùåíèå ÷òî ñåðâåð ñòàðòîíóë è âñå áîëüøå íå ÷åãî íåòó)
ïîìîãàåò òîëüêî ðåñòàðò ñåðâèñà lighttpd
êîíôèã ïðèëîæèë (óæå íå àêòóàëüíî)
ïîìîãèòå ïîæàëóéñòà, ãîòîâ ïðåäîñòàâèòü ìàê. èíôó)
çàðàíåå ñïàñèáî

ïðîâåðèë îòäåëüíî àâòîðèçàöèþ (áåç ssl), ðàáîòàåò
áëèí, èç-çà ÷åãî æå âñå òàêè ssl âèñíèò? ((
ï.ñ. ïîðò 443 îòêðûò
iptables -A INPUT -p tcp --syn --dport 443 -j ACCEPT
ï.ï.ñ. ôàéë S80lighttpd ñòàíäàðòíûé, íå ÷åãî íå òðîãàë

äà, çàáûë íàïèñàòü âåðñèÿ lighttpd 1.4.30

äà, èçâèíÿþñü, ÷òî ÿ íå ðåäàêòèðîâàë ñâîè ñîîáùåíèÿ, ïðè äîáàâëåíèè èíôîðìàöèè,
ïðîñòî öåëûé äåíü ïîòðàòèë íà ýòî è çàäîëáàëñÿ âûÿñíÿòü â ÷åì ïðîáëåìà(

ñîáñòâåííî âîò îòâåò - http://redmine.lighttpd.net/issues/2377
íàäî æäàòü âåðñèþ 1.4.31 ëèáî íàêëàäûâàòü ïàò÷

**ryzhov_al** · 26-12-2011, 06:52

Originally Posted by egorart

äà, çàáûë íàïèñàòü âåðñèÿ lighttpd 1.4.30

ß äóìàë, ÷òî ðå÷ü î âåðñèÿõ èç ïàêåòîâ Optware/OpenWRT. Ïî ãëþêó lighttpd 1.4.30 æå íàäåÿëñÿ, ÷òî âû çàãëÿí¸òå â ñîñåäíþþ âåòêó.

**Johnny_Mnemonic** · 03-05-2012, 16:35

Ïðèâåò âñåì. Óñòàíîâèë lighttpd âåðñèè 1.4.30.
Ñîçäàë pem ôàéë êîìàíäîé openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes
Â êîíôèãå ðàñêîììåíòèë òîëüêî
ssl.engine = "enable"
ssl.pemfile = "server.pem"
lidghttpd ñòàðòóåò íîðìàëüíî, íî ñòîèò òîëüêî áðàóçåðîì îáðàòèòüñÿ íà ïîðò ïî óìîë÷àíèþ 8081, äåìîí ïàäàåò áåç êàêèõ ëèáî çàïèñåé â ëîãàõ.
Åñëè lighttpd çàïóñêàòü ñ êëþ÷îì -D òî ïðè ïàäåíèè â êîíñîëü âûâàëèâàåòñÿ îøèáêà segmentation fault.
Íà îôôèöèàëüíîì ñàéòå íàøåë îïèñàíèå ïîõîæåãî áàãà http://redmine.lighttpd.net/issues/2385.
Êòî íèáóäü ñòàëêèâàëñÿ ñ òàêèìè ïðîáëåìàìè? Êàêèå âàðèàíòû ðåøåíèÿ ìîæî ïðèäóìàòü?

Ìîÿ âåðñèÿ -
lighttpd/1.4.30 (ssl) - a light and fast webserver
Build-Date: Feb 23 2012 21:22:51

**ryzhov_al** · 03-05-2012, 16:58

Originally Posted by Johnny_Mnemonic

Êòî íèáóäü ñòàëêèâàëñÿ ñ òàêèìè ïðîáëåìàìè? Êàêèå âàðèàíòû ðåøåíèÿ ìîæî ïðèäóìàòü?

Code:

$ grep cipher /opt/etc/lighttpd/lighttpd.conf
ssl.cipher-list = "ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"

**Johnny_Mnemonic** · 03-05-2012, 17:37

Originally Posted by ryzhov_al

Code:

$ grep cipher /opt/etc/lighttpd/lighttpd.conf
ssl.cipher-list = "ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"

Äîáàâèë âûøåóêàçàííóþ ñòðîêó â lighttpd.conf è ê ñîæàëåíèþ íè÷åãî íå èçìåíëîñü :-(. Âñå ðàâíî ïàäàåò.
ssl.engine = "enable"
ssl.pemfile = "server.pem"
ssl.cipher-list = "ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"
Êàê ÿ ïîíÿë ýòà ñòðîêà óêàçûâàåò êàêèå ìåòîäû øèôðîâàíèÿ èñïîëüçîâàòü à êàêèå íåò.

Originally Posted by egorart

çäðàâñòâóéòå. ïðîáëåìà âîò êàêàÿ
ïûòàþñü ñäåëàòü lighttpd + ssl + àâòîðèçàöèÿ íà ïàïêó rutorrent ïî ïàðîëþ
äà, çàáûë íàïèñàòü âåðñèÿ lighttpd 1.4.30

Ïîäòâåðæäàþ îøèáêó ñâÿçêè lighttpd 1.4.30+ssl
ñì. ññûëêó http://wl500g.info/showthread.php?90...EA%E0-lighttpd

**ryzhov_al** · 03-05-2012, 19:46

Íå ïîäòâåðæäàþ îøèáêó ñâÿçêè lighttpd 1.4.30+ssl.

lighttpd - ïîñëåäíèé èç ðåïîçèòîðèÿ Entware:

Code:

$ lighttpd -V
lighttpd/1.4.30 (ssl) - a light and fast webserver
Build-Date: May  2 2012 23:27:29
...
Features:
...
        + SSL Support
...

$ opkg list_installed | grep libopenssl
libopenssl - 1.0.1a-1

$ cat /opt/etc/lighttpd/conf.d/30-auth.conf
server.modules += ( "mod_auth" )

auth.backend               = "htdigest"
auth.backend.htdigest.userfile = "/opt/etc/lighttpd/.passwd"
auth.require = (
  "/rutorrent/" =>
    (
        "method"  => "digest",
        "realm"   => "restricted_area", #çàãîëîâîê îêíà çàïðîñà ïàðîëÿ
        "require" => "valid-user"
    )
)

$ grep ssl /opt/etc/lighttpd/lighttpd.conf
ssl.engine                 = "enable"
ssl.pemfile                = "/opt/etc/lighttpd/lighty.pem"
ssl.cipher-list            = "ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"

ãäå /opt/etc/lighttpd/lighty.pem - ñåðòèôèêàò, ñîçäàííûé óòèëèòîé htdigest èç ñîñòàâà apache. Ïðè ñáîðêå lighty 1.4.30 íèêàêèå ïàò÷è íå ïðèìåíÿëèñü.

**Johnny_Mnemonic** · 06-05-2012, 15:08

Originally Posted by ryzhov_al

Code:

$ grep cipher /opt/etc/lighttpd/lighttpd.conf
ssl.cipher-list = "ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"

Ñïàñèáî, ðàçîáðàëñÿ ñ ïðîáëåìîé. Îêàçàëîñü ÷òî ñòàðàÿ ñáîðêà lighttpd 1.4.30 áûëà îò 23 ôåâðàëÿ 12 ãîäà.
Ïëþñ åùå ïðèøëîñü ïåðåøèòü ðîóòåð ïðîøèâêîé ñ ÿäðîì 2.6 ÷òîáû ïåðåéòè íà ðåïîçèòîðèé entware.
Â íîâîì ðåïîçèòîðèè ñáîðêà lighttpd 1.4.30 îò 2 ãî ìàÿ 12 ãîäà.

Originally Posted by ryzhov_al

Íå ïîäòâåðæäàþ îøèáêó ñâÿçêè lighttpd 1.4.30+ssl. lighttpd - ïîñëåäíèé èç ðåïîçèòîðèÿ Entware:
Ïðè ñáîðêå lighty 1.4.30 íèêàêèå ïàò÷è íå ïðèìåíÿëèñü.

Ñïàñèáî ðàçîáðàëñÿ. Ìîå ðåøåíèå â ýòîé âåòêå.

**PTZ-M** · 03-08-2012, 20:56

óñòàë ëîìàòü ãîëîâó íàä çàäà÷åé ïîëó÷èòü äîñòóï ê ëàéòó ïî https (ïîëó÷åíèå ïðîñòîãî ñåðòèôèêàòà ñ ñåâåðà, áåç âñÿêèõ ïàðîëåé/ëîãèíîâ è ò.ä.)

øàìàíþ:

ïðàâëþ êîíô ëàéòà

Code:

#### SSL engine
ssl.engine                 = "enable"
ssl.pemfile                = "/opt/etc/lighttpd/ssl/lighttpd.pem"

ñîçäàþ äèðåêòîðèþ äëÿ ýòîãî ìóñîðà

Code:

mkdir /opt/etc/lighttpd/ssl

ïðóñü òóäà

Code:

cd /opt/etc/lighttpd/ssl

äàëüøå íà÷èíàþ ïëûòü, íî ãåíþ êëþ÷ êàê-òî

Code:

openssl req -newkey rsa:2048 -keyout lighttpd.pem -out lighttpd.pem -days 3650 -nodes

âñ¸ îê - êëþ÷ åñòü, ðåáó÷ó ñåðâàê

Code:

/opt/etc/init.d/S80lighttpd stop
/opt/etc/init.d/S80lighttpd start

è ïóñòîòà...

ïåðåðûë èíåò, íî âåçäå èëè êàê ó ìåíÿ ïî ïðîñòîìó èëè ïàðîé ìåãà æ¸ñòêèõ ñïîñîáîâ ñ ââîäîì ïàðîëåé/êëþ÷åé è ïð. ïðè ïîäêëþ÷åíèè. âñå âàðèàíòû äîëæíû áûòü ðàáî÷èìè, íî âîò íå ôóðû÷èò ðàçà

**PTZ-M** · 20-09-2012, 14:00

Åñòü òàêàÿ âîò ñòàòüÿ - Ñîçäàíèå SSL ïðîêñè ïðè ïîìîùè lighttpd. È àíàëîãè÷íàÿ çàäà÷à:

https-çàïðîñ "ñ ìèðà" ïðèëåòàåò íà -->ðîóòåð ñ lighttpd, êîòîðûé ðàñïðåäåëÿåò--> íà IIS ñåðâåð âíóòðè ñåòè (192.168.0.3:80 - st1.lol.com) èëè îñòàâëÿåò íà lighttpd ñåðâåðå íà ñàìîãî ðîóòåðà (192.168.0.1:8008 - st2.lpl.com)

Èñïðîáîâàë âñå âîçìîæíûå ñïîñîáû, òîëüêî íà ýòî íå ðóãàåòñÿ ïðè ñòàðòå ñåðâåðà:

Code:

#$HTTP["host"] =~ "st2.lpl.com" {
        proxy.server = (
                "" => (
                         ("lpl" => (
                                "host" => "127.0.0.1",
                                "port" => 8008,
                                "fix-redirects" => 1
                                       )
							)
						)
					)
}
$HTTP["host"] =~ "st1.lol.com" {
        proxy.server = (
                "" => (
                         ("lol" => (
                                "host" => "192.168.0.3",
                                "port" => 80,
                                "fix-redirects" => 1
                                    )
                         )
                      )
					)
}

Íî â ëîãàõ ïèøåò:

Code:

2012-09-20 13:20:13: (mod_proxy.c.305) missing key (string): proxy.server  0 host 
2012-09-20 13:20:13: (server.c.945) Configuration of plugins failed. Going down.

Thread: Äîñòóï ê lighttpd ñ ssl òîëüêî ïî ñåðòèôèêàòàì

Thread Tools

Rate This Thread

Display

lighttpd + ssl

lighttpd ïàäàåò ïðè èñïîëüçîâàíèè ssl

Similar Threads

Èíñòàëÿöèÿ è íàñòðîéêà lighttpd

Äîñòóï ê S.M.A.R.T HDD

Äîñòóï ê ðîóòåðó èç ñåòè. Êàê ýòî ñäåëàòü?

How-to Lighttpd, PHP, MySQL and Eaccelerator

Óäàëåííûé äîñòóï

Tags for this Thread

Posting Permissions