Lighttpd setup a password protected directory (directories)

Hello,

Great post .I am new to lightTPD and having trouble implementing the changes to the lighttpd.conf file.

Is there a way you could post the conf in its entirety?

Thanks,

Bryan

Yeah, that would be great. I am having a hard time inserting the tutorial items into my existing conf file.

Thanks, I was able to get it working using your sample as a reference.

As you describe in this detailed post, using plain text password is not secure enough without SSL.

Question: What about using basic htpasswd or htdigest? Are these susceptible to replay attacks also?

Thanks,
Fabian.

Great article, just what I was looking for. I have everything, except for the Chown command. I get the error message stating that there is no such group (or user) as lighttpd. Hope you can help!

If you only want to secure a file (not the entire directory), just add the full path information, e.g.:

auth.require = ( “/docs/secretpage.html” =>
(
“method” => “basic”,
“realm” => “Password protected area”,
“require” => “user=vivek”
)

PCRE support requires for perl style regex config option such as $HTTP[url] =~ ‘^/patj/to’ etc

Please add support package pcre-devel or pcre-lib and recompile lighttpd.

hi,

Aforsaid configuration is working now its my fault.
but now the problem is i have restriced a folder name d as docs in auth.require module and it has a file name as index.htm in it now when ever i run the website in my browser as https://mysite.com/docs/then it will ask me for username and password and after entering the username and password it shows error 404- File Not Found but i have index.htm in the doc folder.

what is the reason for this error.hope you will reply soon

Thanks in advance

Hi,

I’ve a question regarding all this. I don’t kno if it’s possible at all. My nas uses lighttpd for it’s administrative tasks. I use the build in lighttpd as well to serve some pages etc. Now I want to set a password on a folder. The admin function uses a password already and I want the same, I just want to add my folder that needs password protection. I have been trying to alter the conf file, but with no luck. Maybe you can shed some light on it? conf file pasted below:

server.document-root = “/usr/www/lib/”
server.pid-file = “/var/run/lighttpd.pid”
server.errorlog = “/var/log/lighttpd/error.log”
dir-listing.activate = “enable”

server.port = 5000

server.username = “www-data”
server.groupname = “www-data”

server.modules = (
“mod_auth”,
“mod_access”,
“mod_alias”,
“mod_cgi”,
“mod_fastcgi”,
“mod_accesslog”
)

server.errorfile-prefix = “/usr/www/lib/error-”

mimetype.assign = (
“.html” => “text/html”,
“.txt” => “text/plain”,
“.jpg” => “image/jpeg”,
“.png” => “image/png”,
“.gif” => “image/gif”,
“.css” => “text/css”
)

accesslog.filename = “/var/log/lighttpd/access.log”

static-file.exclude-extensions = ( “.fcgi”, “.php”, “.rb”, “~”, “.inc”, “.cgi” )
index-file.names = ( “nasMaster.pl” )

# bruce – I don’t think we need this now…
#cgi.assign = ( “.cgi” => “/usr/bin/perl” )

alias.url = ( “/auth” => “/usr/www/lib” )

auth.backend = “htdigest”
auth.backend.htdigest.userfile = “/var/private/lighttpd.htdigest.user”
auth.require = ( “/auth” =>
(
“method” => “digest”,
“realm” => “nas admin”,
“require” => “valid-user”
# bruce – removed user=
# “require” => “user=admin”

)

)

fastcgi.debug = 0

# Bruce – Removed host & port and replaced with a socket
# “host” => “127.0.0.1″,
# “port” => 1026,
fastcgi.server = ( “.pl” =>
(( “socket” => “/tmp/lighttpd.fcgi.socket”,
“bin-path” => “/usr/www/lib/nasMaster.pl”,
“check-local” => “disable”,
“min-procs” => 1,
“max-procs” => 1,
“idle-timeout” => 30,
“bin-environment” => (
# Environment variables for nasMaster.pl
“PERL5LIB” => “/usr/www/lib”,
“NAS_NBIN” => “/usr/www/nbin”,
),
)),
“nasMaster.pl” => (( “socket” => “/tmp/lighttpd.fcgi.socket”,
“check-local” => “disable”,
))
)

Vincent,

Make file readonly using chattr or chmod.

Paul,

Just append a new user / password

HTH

you can add multiple users by sparating them with a tilde.
eg.
“require” => “user=user1|user=user2″

directory listings can be enabled or disabled using

server.dir-listing = "enable"

Turn on listing for /docs/ only:

$HTTP["url"] =~ "^/docs($|/)" {   server.dir-listing = "enable"   }

Hi,

Is there a way to protect different directories with different password files.

mesut had a good question. Does anyone know how to password protect different directories with different user/password?

Example:
domain.com/stuff restricted to guest
domain.com/mystuff restricted to userx

Thanks

Just a quick note as far as step one, a simple command would be lighty-enable-mod auth
Otherwise Great Post! Thanks!

hi,
i just migrate apache to lighttpd. i found i can not find easy and straightforward way
to enable auth for every users since all my users has .htpassword in public_html
any straightforward way to enable auth for every /home/$user/public_html/ ?

thanks!

Along the lines of what Paul posted, I’m trying to password protect a directory for multiple users. You posted that you should simply append a new user to the end of the /etc/lighttpd/lighttpd.conf file, but I’m confused about the formatting. Should it look like:


auth.require = ( "/media/" =>
(
"method" => "basic",
"realm" => "Media",
"require" => "user=user1"
"require" => "user=user2"
)

Or should it look like:

auth.require = ( "/media/" =>
(
"method" => "basic",
"realm" => "Media",
"require" => "user=user1|user=user2"
)

?

Also, what should the password file look like in order to do this? Thanks!