Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We want to run an SSL only lighttpd process. Which configuration option should be used to turn off port 80 with its unencrypted traffic ?

Lighttpd documents only provide a "redirection" to https traffic, but we want a complete silence on port 80. We want to keep lighttpd listening only on 443 for encrypted(https) traffic.

Update [Solution]

Setting only "server.port = 443" does not help. SSL config was :

$SERVER["socket"] == "0.0.0.0:443" {
                  ssl.engine                  = "enable"
                  ssl.pemfile                 = "/etc/cert.pem"
}

That gave the error.

can't bind to port: 0.0.0.0 443 Address already in use

Removing the conditional SSL altogether solved the issue, the config became:

server.port                 = 443
ssl.engine                  = "enable"
ssl.pemfile                 = "myweb.pem"
share|improve this question

4 Answers 4

up vote 3 down vote accepted

you have to set server.port = 443 in lighttpd.conf and comment the conditional $SERVER["socket"] == "0.0.0.0:443" { } in 10-ssl.conf

keep ssl.engine = "enable" and ssl.pemfile = "/etc/lighttpd/server.pem" in 10-ssl.conf

share|improve this answer

How about, commenting out

# /etc/rc.d/lighttpd start

Or, you could comment out the fastcgi.server lines in

/etc/lighttpd/lighttpd.conf


Ok, this is the reference I was looking for, are you using these things?

I think the bottom line is, if you just make the server.port 443 and
remove the port 80 config entirely instead of a redirect, the server would respond only on 443.

share|improve this answer
    
we want to disable http traffic and keep only http**s** traffic. We are not even using fastcgi or php. –  hayalci Jul 28 '09 at 10:35
    
Ok, then does the last part I just added work on your configuration? –  nik Jul 28 '09 at 10:39
    
changing server port only with the recommended ssl config snippet didn't work. See the question for working solution. thanks for the pointer. –  hayalci Jul 28 '09 at 10:56

Not a solution but still a work around would be to install a firewall such as Iptables and completely block traffic on port 80.

share|improve this answer
    
An iptables trick should also stop incoming port-80 traffic. Unless, you want to run something else there. –  nik Jul 28 '09 at 10:37

In my case, I had to comment:

   include_shell "/usr/share/lighttpd/use-ipv6.pl" 

to disable additional SSL pre-configuration.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.