Mod aaa-12 add lighttpd
RCA: SOL: 修改人:zhouwuqing 检视人:zhouwuqing
This commit is contained in:
zhouwuqing
parent
21bb177b89
commit
581ddd4652
libs/files/lighttpd
config
portal_log
portal_upload
portal_webpages
|
|
@ -0,0 +1,155 @@
|
|||
|
||||
#var.log_root = "/home/cmhi/secogateway/libs/files/lighttpd/log"
|
||||
var.server_root = "/home/cmhi/secogateway/libs/files/lighttpd"
|
||||
#var.state_dir = "/home/cmhi/secogateway/libs/files/lighttpd"
|
||||
#var.home_dir = "/home/cmhi/secogateway/libs/files/lighttpd"
|
||||
#var.conf_dir = "/home/cmhi/secogateway/libs/files/lighttpd/config"
|
||||
|
||||
var.log_root = server_root + "/portal_log"
|
||||
|
||||
var.state_dir = server_root
|
||||
var.home_dir = server_root
|
||||
var.conf_dir = server_root + "/config"
|
||||
|
||||
var.vhosts_dir = server_root + "/portal_vhosts"
|
||||
|
||||
var.cache_dir = server_root + "/portal_cache"
|
||||
|
||||
var.socket_dir = home_dir + "/portal_sockets"
|
||||
|
||||
include "portal_modules.conf"
|
||||
|
||||
server.port = 8081
|
||||
|
||||
server.use-ipv6 = "disable"
|
||||
|
||||
#server.username = "lighttpd"
|
||||
#server.groupname = "lighttpd"
|
||||
|
||||
server.document-root = server_root + "/portal_webpages"
|
||||
|
||||
server.pid-file = state_dir + "/portal_lighttpd.pid"
|
||||
|
||||
server.errorlog = log_root + "/error.log"
|
||||
|
||||
include "conf.d/access_log.conf"
|
||||
|
||||
include "conf.d/debug.conf"
|
||||
|
||||
server.event-handler = "linux-sysepoll"
|
||||
|
||||
##
|
||||
## The basic network interface for all platforms at the syscalls read()
|
||||
## and write(). Every modern OS provides its own syscall to help network
|
||||
## servers transfer files as fast as possible
|
||||
##
|
||||
## sendfile - is recommended for small files.
|
||||
## writev - is recommended for sending many large files
|
||||
##
|
||||
server.network-backend = "sendfile"
|
||||
|
||||
|
||||
server.max-fds = 2048
|
||||
|
||||
server.stat-cache-engine = "simple"
|
||||
|
||||
server.max-connections = 1024
|
||||
|
||||
index-file.names += (
|
||||
"index.xhtml", "index.html", "index.htm", "default.htm", "index.php"
|
||||
)
|
||||
|
||||
url.access-deny = ( "~", ".inc" )
|
||||
|
||||
|
||||
static-file.exclude-extensions = ( ".php", ".pl", ".fcgi", ".scgi" )
|
||||
|
||||
|
||||
|
||||
include "conf.d/mime.conf"
|
||||
|
||||
include "conf.d/dirlisting.conf"
|
||||
|
||||
server.follow-symlink = "enable"
|
||||
|
||||
|
||||
server.upload-dirs = ( server_root + "/portal_upload" )
|
||||
|
||||
|
||||
|
||||
#######################################################################
|
||||
##
|
||||
## SSL Support
|
||||
## -------------
|
||||
##
|
||||
## To enable SSL for the whole server you have to provide a valid
|
||||
## certificate and have to enable the SSL engine.::
|
||||
##
|
||||
## ssl.engine = "enable"
|
||||
## ssl.pemfile = "/path/to/server.pem"
|
||||
##
|
||||
## The HTTPS protocol does not allow you to use name-based virtual
|
||||
## hosting with SSL. If you want to run multiple SSL servers with
|
||||
## one lighttpd instance you must use IP-based virtual hosting: ::
|
||||
##
|
||||
## Mitigate CVE-2009-3555 by disabling client triggered renegotation
|
||||
## This is enabled by default.
|
||||
##
|
||||
## IMPORTANT: this setting can only be used in the global scope.
|
||||
## It does *not* work inside conditionals
|
||||
##
|
||||
# ssl.disable-client-renegotiation = "enable"
|
||||
##
|
||||
## $SERVER["socket"] == "10.0.0.1:443" {
|
||||
## ssl.engine = "enable"
|
||||
## ssl.pemfile = "/etc/ssl/private/www.example.com.pem"
|
||||
## #
|
||||
## # (Following SSL/TLS Deployment Best Practices 1.3 / 17 September 2013 from:
|
||||
## # https://www.ssllabs.com/projects/best-practices/index.html)
|
||||
## # - BEAST is considered mitigaed on client side now, and new weaknesses have been found in RC4,
|
||||
## # so it is strongly advised to disable RC4 ciphers (HIGH doesn't include RC4)
|
||||
## # - It is recommended to disable 3DES too (although disabling RC4 and 3DES breaks IE6+8 on Windows XP,
|
||||
## # so you might want to support 3DES for now - just remove the '!3DES' parts below).
|
||||
## # - The examples below prefer ciphersuites with "Forward Secrecy" (and ECDHE over DHE (alias EDH)), remove '+kEDH +kRSA'
|
||||
## # if you don't want that.
|
||||
## # - SRP and PSK are not supported anyway, excluding those ('!kSRP !kPSK') just keeps the list smaller (easier to review)
|
||||
## # Check your cipher list with: openssl ciphers -v '...' (use single quotes as your shell won't like ! in double quotes)
|
||||
## #
|
||||
## # If you know you have RSA keys (standard), you can use:
|
||||
## ssl.cipher-list = "aRSA+HIGH !3DES +kEDH +kRSA !kSRP !kPSK"
|
||||
## # The more generic version (without the restriction to RSA keys) is
|
||||
## # ssl.cipher-list = "HIGH !aNULL !3DES +kEDH +kRSA !kSRP !kPSK"
|
||||
## #
|
||||
## # Make the server prefer the order of the server side cipher suite instead of the client suite.
|
||||
## # This option is enabled by default, but only used if ssl.cipher-list is set.
|
||||
## #
|
||||
## # ssl.honor-cipher-order = "enable"
|
||||
## #
|
||||
## server.name = "www.example.com"
|
||||
##
|
||||
## server.document-root = "/srv/www/vhosts/example.com/www/"
|
||||
## }
|
||||
##
|
||||
|
||||
## If you have a .crt and a .key file, cat them together into a
|
||||
## single PEM file:
|
||||
## $ cat /etc/ssl/private/lighttpd.key /etc/ssl/certs/lighttpd.crt \
|
||||
## > /etc/ssl/private/lighttpd.pem
|
||||
##
|
||||
#ssl.pemfile = "/etc/ssl/private/lighttpd.pem"
|
||||
|
||||
##
|
||||
## optionally pass the CA certificate here.
|
||||
##
|
||||
##
|
||||
#ssl.ca-file = ""
|
||||
|
||||
##
|
||||
## and the CRL revocation list here.
|
||||
##
|
||||
##
|
||||
#ssl.ca-crl-file = ""
|
||||
|
||||
##
|
||||
#######################################################################
|
||||
|
||||
|
|
@ -0,0 +1,179 @@
|
|||
#######################################################################
|
||||
##
|
||||
## Modules to load
|
||||
## -----------------
|
||||
##
|
||||
## at least mod_access and mod_accesslog should be loaded
|
||||
## all other module should only be loaded if really neccesary
|
||||
##
|
||||
## - saves some time
|
||||
## - saves memory
|
||||
##
|
||||
## the default module set contains:
|
||||
##
|
||||
## "mod_indexfile", "mod_dirlisting", "mod_staticfile"
|
||||
##
|
||||
## you dont have to include those modules in your list
|
||||
##
|
||||
## Modules, which are pulled in via conf.d/*.conf
|
||||
##
|
||||
## NOTE: the order of modules is important.
|
||||
##
|
||||
## - mod_accesslog -> conf.d/access_log.conf
|
||||
## - mod_compress -> conf.d/compress.conf
|
||||
## - mod_status -> conf.d/status.conf
|
||||
## - mod_webdav -> conf.d/webdav.conf
|
||||
## - mod_cml -> conf.d/cml.conf
|
||||
## - mod_evhost -> conf.d/evhost.conf
|
||||
## - mod_simple_vhost -> conf.d/simple_vhost.conf
|
||||
## - mod_mysql_vhost -> conf.d/mysql_vhost.conf
|
||||
## - mod_trigger_b4_dl -> conf.d/trigger_b4_dl.conf
|
||||
## - mod_userdir -> conf.d/userdir.conf
|
||||
## - mod_rrdtool -> conf.d/rrdtool.conf
|
||||
## - mod_ssi -> conf.d/ssi.conf
|
||||
## - mod_cgi -> conf.d/cgi.conf
|
||||
## - mod_scgi -> conf.d/scgi.conf
|
||||
## - mod_fastcgi -> conf.d/fastcgi.conf
|
||||
## - mod_proxy -> conf.d/proxy.conf
|
||||
## - mod_secdownload -> conf.d/secdownload.conf
|
||||
## - mod_expire -> conf.d/expire.conf
|
||||
##
|
||||
|
||||
server.modules = (
|
||||
"mod_webm",
|
||||
# "mod_access",
|
||||
# "mod_alias",
|
||||
# "mod_auth",
|
||||
# "mod_authn_file",
|
||||
# "mod_evasive",
|
||||
# "mod_redirect",
|
||||
# "mod_rewrite",
|
||||
# "mod_setenv",
|
||||
# "mod_usertrack",
|
||||
)
|
||||
|
||||
##
|
||||
#######################################################################
|
||||
|
||||
#######################################################################
|
||||
##
|
||||
## Config for various Modules
|
||||
##
|
||||
|
||||
##
|
||||
## mod_geoip
|
||||
##
|
||||
#include "conf.d/geoip.conf"
|
||||
|
||||
##
|
||||
## mod_ssi
|
||||
##
|
||||
#include "conf.d/ssi.conf"
|
||||
|
||||
##
|
||||
## mod_status
|
||||
##
|
||||
#include "conf.d/status.conf"
|
||||
|
||||
##
|
||||
## mod_webdav
|
||||
##
|
||||
#include "conf.d/webdav.conf"
|
||||
|
||||
##
|
||||
## mod_compress
|
||||
##
|
||||
#include "conf.d/compress.conf"
|
||||
|
||||
##
|
||||
## mod_userdir
|
||||
##
|
||||
#include "conf.d/userdir.conf"
|
||||
|
||||
##
|
||||
## mod_magnet
|
||||
##
|
||||
#include "conf.d/magnet.conf"
|
||||
|
||||
##
|
||||
## mod_cml
|
||||
##
|
||||
#include "conf.d/cml.conf"
|
||||
|
||||
##
|
||||
## mod_rrdtool
|
||||
##
|
||||
#include "conf.d/rrdtool.conf"
|
||||
|
||||
##
|
||||
## mod_proxy
|
||||
##
|
||||
#include "conf.d/proxy.conf"
|
||||
|
||||
##
|
||||
## mod_expire
|
||||
##
|
||||
#include "conf.d/expire.conf"
|
||||
|
||||
##
|
||||
## mod_secdownload
|
||||
##
|
||||
#include "conf.d/secdownload.conf"
|
||||
|
||||
##
|
||||
#######################################################################
|
||||
|
||||
#######################################################################
|
||||
##
|
||||
## CGI modules
|
||||
##
|
||||
|
||||
##
|
||||
## SCGI (mod_scgi)
|
||||
##
|
||||
#include "conf.d/scgi.conf"
|
||||
|
||||
##
|
||||
## FastCGI (mod_fastcgi)
|
||||
##
|
||||
#include "conf.d/fastcgi.conf"
|
||||
|
||||
##
|
||||
## plain old CGI (mod_cgi)
|
||||
##
|
||||
#include "conf.d/cgi.conf"
|
||||
|
||||
##
|
||||
#######################################################################
|
||||
|
||||
#######################################################################
|
||||
##
|
||||
## VHost Modules
|
||||
##
|
||||
## Only load ONE of them!
|
||||
## ========================
|
||||
##
|
||||
|
||||
##
|
||||
## You can use conditionals for vhosts aswell.
|
||||
##
|
||||
## see https://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_Configuration
|
||||
##
|
||||
|
||||
##
|
||||
## mod_evhost
|
||||
##
|
||||
#include "conf.d/evhost.conf"
|
||||
|
||||
##
|
||||
## mod_simple_vhost
|
||||
##
|
||||
#include "conf.d/simple_vhost.conf"
|
||||
|
||||
##
|
||||
## mod_mysql_vhost
|
||||
##
|
||||
#include "conf.d/mysql_vhost.conf"
|
||||
|
||||
##
|
||||
#######################################################################
|
||||
|
|
@ -0,0 +1,154 @@
|
|||
|
||||
#var.log_root = "/home/cmhi/secogateway/libs/files/lighttpd/log"
|
||||
var.server_root = "/home/cmhi/secogateway/libs/files/lighttpd"
|
||||
#var.state_dir = "/home/cmhi/secogateway/libs/files/lighttpd"
|
||||
#var.home_dir = "/home/cmhi/secogateway/libs/files/lighttpd"
|
||||
#var.conf_dir = "/home/cmhi/secogateway/libs/files/lighttpd/config"
|
||||
|
||||
var.log_root = server_root + "/log"
|
||||
var.state_dir = server_root
|
||||
var.home_dir = server_root
|
||||
var.conf_dir = server_root + "/config"
|
||||
|
||||
var.vhosts_dir = server_root + "/vhosts"
|
||||
|
||||
var.cache_dir = server_root + "/cache"
|
||||
|
||||
var.socket_dir = home_dir + "/sockets"
|
||||
|
||||
include "modules.conf"
|
||||
|
||||
server.port = 8080
|
||||
|
||||
server.use-ipv6 = "disable"
|
||||
|
||||
#server.username = "lighttpd"
|
||||
#server.groupname = "lighttpd"
|
||||
|
||||
server.document-root = server_root + "/webpages"
|
||||
|
||||
server.pid-file = state_dir + "/lighttpd.pid"
|
||||
|
||||
server.errorlog = log_root + "/error.log"
|
||||
|
||||
include "conf.d/access_log.conf"
|
||||
|
||||
include "conf.d/debug.conf"
|
||||
|
||||
server.event-handler = "linux-sysepoll"
|
||||
|
||||
##
|
||||
## The basic network interface for all platforms at the syscalls read()
|
||||
## and write(). Every modern OS provides its own syscall to help network
|
||||
## servers transfer files as fast as possible
|
||||
##
|
||||
## sendfile - is recommended for small files.
|
||||
## writev - is recommended for sending many large files
|
||||
##
|
||||
server.network-backend = "sendfile"
|
||||
|
||||
|
||||
server.max-fds = 2048
|
||||
|
||||
server.stat-cache-engine = "simple"
|
||||
|
||||
server.max-connections = 1024
|
||||
|
||||
index-file.names += (
|
||||
"index.xhtml", "index.html", "index.htm", "default.htm", "index.php"
|
||||
)
|
||||
|
||||
url.access-deny = ( "~", ".inc" )
|
||||
|
||||
|
||||
static-file.exclude-extensions = ( ".php", ".pl", ".fcgi", ".scgi" )
|
||||
|
||||
|
||||
|
||||
include "conf.d/mime.conf"
|
||||
|
||||
include "conf.d/dirlisting.conf"
|
||||
|
||||
server.follow-symlink = "enable"
|
||||
|
||||
|
||||
server.upload-dirs = ( server_root + "/upload" )
|
||||
|
||||
|
||||
|
||||
#######################################################################
|
||||
##
|
||||
## SSL Support
|
||||
## -------------
|
||||
##
|
||||
## To enable SSL for the whole server you have to provide a valid
|
||||
## certificate and have to enable the SSL engine.::
|
||||
##
|
||||
## ssl.engine = "enable"
|
||||
## ssl.pemfile = "/path/to/server.pem"
|
||||
##
|
||||
## The HTTPS protocol does not allow you to use name-based virtual
|
||||
## hosting with SSL. If you want to run multiple SSL servers with
|
||||
## one lighttpd instance you must use IP-based virtual hosting: ::
|
||||
##
|
||||
## Mitigate CVE-2009-3555 by disabling client triggered renegotation
|
||||
## This is enabled by default.
|
||||
##
|
||||
## IMPORTANT: this setting can only be used in the global scope.
|
||||
## It does *not* work inside conditionals
|
||||
##
|
||||
# ssl.disable-client-renegotiation = "enable"
|
||||
##
|
||||
## $SERVER["socket"] == "10.0.0.1:443" {
|
||||
## ssl.engine = "enable"
|
||||
## ssl.pemfile = "/etc/ssl/private/www.example.com.pem"
|
||||
## #
|
||||
## # (Following SSL/TLS Deployment Best Practices 1.3 / 17 September 2013 from:
|
||||
## # https://www.ssllabs.com/projects/best-practices/index.html)
|
||||
## # - BEAST is considered mitigaed on client side now, and new weaknesses have been found in RC4,
|
||||
## # so it is strongly advised to disable RC4 ciphers (HIGH doesn't include RC4)
|
||||
## # - It is recommended to disable 3DES too (although disabling RC4 and 3DES breaks IE6+8 on Windows XP,
|
||||
## # so you might want to support 3DES for now - just remove the '!3DES' parts below).
|
||||
## # - The examples below prefer ciphersuites with "Forward Secrecy" (and ECDHE over DHE (alias EDH)), remove '+kEDH +kRSA'
|
||||
## # if you don't want that.
|
||||
## # - SRP and PSK are not supported anyway, excluding those ('!kSRP !kPSK') just keeps the list smaller (easier to review)
|
||||
## # Check your cipher list with: openssl ciphers -v '...' (use single quotes as your shell won't like ! in double quotes)
|
||||
## #
|
||||
## # If you know you have RSA keys (standard), you can use:
|
||||
## ssl.cipher-list = "aRSA+HIGH !3DES +kEDH +kRSA !kSRP !kPSK"
|
||||
## # The more generic version (without the restriction to RSA keys) is
|
||||
## # ssl.cipher-list = "HIGH !aNULL !3DES +kEDH +kRSA !kSRP !kPSK"
|
||||
## #
|
||||
## # Make the server prefer the order of the server side cipher suite instead of the client suite.
|
||||
## # This option is enabled by default, but only used if ssl.cipher-list is set.
|
||||
## #
|
||||
## # ssl.honor-cipher-order = "enable"
|
||||
## #
|
||||
## server.name = "www.example.com"
|
||||
##
|
||||
## server.document-root = "/srv/www/vhosts/example.com/www/"
|
||||
## }
|
||||
##
|
||||
|
||||
## If you have a .crt and a .key file, cat them together into a
|
||||
## single PEM file:
|
||||
## $ cat /etc/ssl/private/lighttpd.key /etc/ssl/certs/lighttpd.crt \
|
||||
## > /etc/ssl/private/lighttpd.pem
|
||||
##
|
||||
#ssl.pemfile = "/etc/ssl/private/lighttpd.pem"
|
||||
|
||||
##
|
||||
## optionally pass the CA certificate here.
|
||||
##
|
||||
##
|
||||
#ssl.ca-file = ""
|
||||
|
||||
##
|
||||
## and the CRL revocation list here.
|
||||
##
|
||||
##
|
||||
#ssl.ca-crl-file = ""
|
||||
|
||||
##
|
||||
#######################################################################
|
||||
|
||||
|
|
@ -0,0 +1 @@
|
|||
|
||||
|
|
@ -0,0 +1 @@
|
|||
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
"welcome auth portal"
|
||||
</html>
|
||||
Loading…
Reference in New Issue