Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

After two days of searching, I decided to ask this question here:

I have extremely limited lighttpd installed on my iDevice, and I need to redirect all received https traffic to http. I don't have mod_rewrite nor do I have ssl compiled in.

I came up with this, but it doesn't seem to work:

$SERVER["socket"] == ":443" {
 $HTTP["host"] =~ ".*" {
  url.redirect = ( ".*" => "http://%1" )
 }
}

Also, for lighttpd to get the port 443 traffic, do I need to set server.port to 443, or can I just leave it = 80 in the config file?

Thanks in advance!

share|improve this question

1 Answer 1

up vote 1 down vote accepted

If you're not using SSL, then your version of lighttpd will be unable to respond to an incoming HTTPS request as it will be unable to decode the response (which will be SSL encrypted by the client's browser).

It will also be unable to reply over HTTPS with the Redirect reply.

You'll need to compile Lighttpd with SSL support, or put at least something in there on port 443 which can decrypt SSL (perhaps openssl with the s_server option in HTTPS mode).

share|improve this answer
    
I thought that the servername isn't encrypted when https is used. What I mean is: in example.com/stuffhere, example.com isn't encrypted, is visible (which you can see when doing arp and dns spoofing), while stuffhere is encrypted. –  linkxs Oct 17 '11 at 17:02
    
@linkxs No, all traffic from the initiation of the HTTP request is encrypted. Clients connecting to your server with https:// in their address bar will get an error. –  Shane Madden Oct 17 '11 at 18:21
    
Then how come arpspoof catches facebook.com? The issue is that it can't do anything with it past that point. –  linkxs Oct 17 '11 at 23:37
    
Because arpspoofing catches it at a lower layer. It depends on how the attack is done (dns spoofing), but arpspoofing intercepts all traffic between the client and the gateway. –  Trcx Mar 13 '13 at 21:52
    
wow, bringing this comment back from the dead after quite a break! Anyway, there's DNS spoofing, or alternatively SNI which can be used to do this. Also, if someone happens to type "facebook.com" into a browser, even if they're redirected from the plain HTTP URL to the HTTPS one, it's possible to capture the first request and /not/ issue the HTTP->HTTPS redirect, and instead perform an MITM attack. –  JamesHannah Mar 14 '13 at 17:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.