4

We want to run an SSL only lighttpd process. Which configuration option should be used to turn off port 80 with its unencrypted traffic ?

Lighttpd documents only provide a "redirection" to https traffic, but we want a complete silence on port 80. We want to keep lighttpd listening only on 443 for encrypted(https) traffic.

Update [Solution]

Setting only "server.port = 443" does not help. SSL config was :

$SERVER["socket"] == "0.0.0.0:443" {
                  ssl.engine                  = "enable"
                  ssl.pemfile                 = "/etc/cert.pem"
}

That gave the error.

can't bind to port: 0.0.0.0 443 Address already in use

Removing the conditional SSL altogether solved the issue, the config became:

server.port                 = 443
ssl.engine                  = "enable"
ssl.pemfile                 = "myweb.pem"
5

you have to set server.port = 443 in lighttpd.conf and comment the conditional $SERVER["socket"] == "0.0.0.0:443" { } in 10-ssl.conf

keep ssl.engine = "enable" and ssl.pemfile = "/etc/lighttpd/server.pem" in 10-ssl.conf

2

How about, commenting out

# /etc/rc.d/lighttpd start

Or, you could comment out the fastcgi.server lines in

/etc/lighttpd/lighttpd.conf  

Ok, this is the reference I was looking for, are you using these things?

I think the bottom line is, if you just make the server.port 443 and
remove the port 80 config entirely instead of a redirect, the server would respond only on 443.

  • we want to disable http traffic and keep only https traffic. We are not even using fastcgi or php. – hayalci Jul 28 '09 at 10:35
  • Ok, then does the last part I just added work on your configuration? – nik Jul 28 '09 at 10:39
  • changing server port only with the recommended ssl config snippet didn't work. See the question for working solution. thanks for the pointer. – hayalci Jul 28 '09 at 10:56
0

Not a solution but still a work around would be to install a firewall such as Iptables and completely block traffic on port 80.

  • An iptables trick should also stop incoming port-80 traffic. Unless, you want to run something else there. – nik Jul 28 '09 at 10:37
0

In my case, I had to comment:

   include_shell "/usr/share/lighttpd/use-ipv6.pl" 

to disable additional SSL pre-configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.