Per-directory configuration (.htaccess) in LightTPD

thanks for this page, it helped me alot.

but as ruby is often not installed on servers by default and perl is some kind of dinosaur nowadays (and often not installed, neither), i translated the script to python.

probably it could be optimized in some ways (maybe context updated instead of recreated for each vserver or replacing %dir|path|host% by simple string-replace instead of regexps) but as it runs just once when the server is started i don't see an issue here. i didn't implement the replacement for %conf%.

SECURITY ISSUE: the per-vhost conf files still should not be user-writable (as others mentioned already)!

#!/usr/bin/env python
import os, sys, re

reg = re.compile( '%(\w+)%' )

confName = 'lighttpd.conf'
path = os.path.realpath( os.path.dirname( sys.argv[0] ) )
globalConfName = os.path.join( path, confName )

def readConf( conf, context ):
        if os.path.isfile( conf ):
                fp = open( conf, 'r' )
                for line in fp.readlines():
                        line = reg.sub( lambda X: context.get(X.group(1), '%%%s%%'%X.group(1)), line )
                print '    %s' % line
                fp.close()

for host in os.listdir( path ):
        if host[0] == '.':
                continue
        dir = os.path.join( path, host )
        if os.path.isdir( dir ):
                print '$HTTP["host"] == "%s" {' % host
                context = { 'dir':dir, 'path':path, 'host':host }
                readConf( globalConfName, context )
                readConf( os.path.join(dir, confName), context )
                print '}'

I wanted to have per-host config options in the database, using mysql-vhost, so I did this (see per-vhost stuff I wrote at bottom): MySQL-based vhosting

Yes, but that is a problem not specific to this solution but to lighty in general. If you combine execwrap and this solution you get pretty much what you are looking for, except safely user-modifiable .htaccess files. For those you could simply patch the lighty sources and disable the global directive. Easy.

-- Hannes

Ok, I was looking for user-modifiable .htaccess solution for lighty and I somehow didn't notice something else was described here :-) Thanks for clearing this up.
But the problem of scripts' privileges still exists. Even if the server is running as lighttpd user, every user's scripts are ran as lighttpd user also. Lighttpd needs to have read access to all the script files. So basically every user's scripts have exactly the same permissions, ie. they can read each other's script files. So if I have config.php with my passwords, every user can read that by putting something like file_get_contents( "/path/to/my/config.php" ) in their php script. With rails there's a separate config directory that can be read.
If you're in a trusted environment (users know each other and have no reason to get their hands on others' databases) everything is cool, but if you have some semi-trusted or untrusted users things get complicated. This is why stuff like suexec and execwrap exists :/

cheers
--
robzon

I think that there is a misunderstanding here. This was never intended to be used in a scenario where users have write access to their respective lighttpd.conf. Furthermore, the only script that is executed is vhost-lighttpd.conf.rb. And AFAIK it is run as the lighttpd user. So it is even possible to disallow read access to lighttpd.conf if you're worried about confidential info in that file. There shouldn't be any, though. Database credentials shouldn't be in that file anyways.

But you are right, if you wanted to use this in a scenario where users have write access to their local lighttpd.conf you would have to lock it down somehow.

-- Hannes

There are 2 security flaws in this unfortunately.

First flaw is that as far as I know mod_simple_vhost doesn't drop privileges, so that every user's scripts are run as nobody.nogroup (or whatever it is on your distro). So basically, users have read access to each other's files making it really insecure (they could for example read database passwords!).

Second flaw is here: "In order to make sure that the directives in each of these configuration file only apply to one particular virtual host, the script wraps the content of each file in a conditional." There is a global context (http://trac.lighttpd.net/trac/wiki/Docs%3AConfiguration#global-context) which allows to get out of conditional, so basically everyone can change lighttpd's global settings. I've solved the first problem by using my custom version of execwrap (just added user/groupname to uid/gid mapping).

The second problem is somewhat problematic. I guess one of the solutions would be to omit files with global context keyword.
A better solution would be to patch lighttpd and add something like "unsafe context", a context where global context doesn't work, so:

unsafe {
  global {
    # nope, this is not possible in unsafe context
  }
}

wouldn't work.

cheers.

That is so cool! Thanks for contributing!

-- Hannes

Here's a Perl version of this nice script. It's a bit messy, but hey, it's Perl :-)

#! /usr/bin/perl -w
#
# -*- perl -*-
#
# lighttpd-vhost.conf.pl
#

use strict;
use File::Basename;

my $conf_name = "lighttpd.conf";
my $path = dirname($0);
my $global_conf_name = $path . "/" . $conf_name;

sub readconf($%)
{
    my ($conf, %context) = @_;

    if (open(CONF, $conf)) {
        while (<CONF>) {
            s/%(\w+)%/{exists $context{$1} ? $context{$1} : '%'.$1.'%'}/geo;
            print "    " . $_;
        }
    }
}

opendir(VHOSTDIR, $path) or die "$path: can't open directory\n";
while (my $host = readdir(VHOSTDIR)) {
    if ($host !~ /^\.\.?$/o and -d ($path . '/' . $host)) {
        my $dir = $path . '/' . $host;
        my %context = ('path', $path, 'dir', $dir, 'host', $host);
        print "\$HTTP[\"host\"] == \"$host\" {\n";
        readconf($global_conf_name, %context);
        readconf($dir . '/' . $conf_name, %context);
        print "}\n";
    }
}
closedir(VHOSTDIR);

RoR is an entirely different story. When I setup Rails it seemed to me that the Rails-Lighty integration was in the flux. That was two months ago. I kinda got it working but wasn't 100% confident about wether I got it all right. One thing should be noted: the solution presented here can be used for any lighttpd.conf statement, including the ones used for integrating Rails into Lighty.

-- Hannes

PS: In case you're wondering where you're second post went: We don't allow URL-drops here. Sorry. ;-)

Hannes, is there a RoR url redirect/rewrite directive you could share along with this excellent system? I have been using this script for my PHP hosting for some time now but am getting "Not Found" errors when trying to do RoR hosting.

Thanks for posting this, are those ruby or lighttpd variables?

Hannes Schmidt,

I hear that this is the ultimate cyber gathering place for computer weasles. To this I say, Alle ist klar herr Kommissar.

Big Dolphin Daddy
Cal State Sacramento Implementation King