lighttpd

Be wary of what folks can upload into the "files" directories on your Drupal site. They may be able to upload a PHP file, then try to access that PHP file in their web browser, thus being able to execute arbitrary code. This is dangerous!

I believe Drupal's .htaccess files block this sort of thing for Apache users, but what about us Lighty users? Fortunately, it's not too tough to stop this from happening; just add something like this to Lighty's config file:

I am currently running a multisite installation with Drupal 6.13 on Lighttpd 1.4.19 and facing issues when creating Drupal sites in subdirectories.
After reading through countles posts here on the drupal sites, as well on lighttpd I am close to converting back to Apache as I can't get this to work.
The drupal directory structure looks like this

Drupal root: /home/www/drupal/sites

+sites
|______all
|______default
|______domain.com
|______blogs.domain.com
|______blogs.domain.com.blog1
|______blogs.domain.com.blog2

For those looking to have Drupal serve private files efficiently, I've posted a simple core patch that adds X-Sendfile support:
http://drupal.org/node/74472