lighttpd

I've seen this post today:

http://www.welivesecurity.com/2013/05/07/linuxcdorked-malware-lighttpd-a...

It looks like something went terrible.

What should we do with our servers and Drupal installations?

I’ve had this idea for quite some time and could find any solution , so I was about to start coding but though it’s better to share it with you before I start to make sure that no one else is working on something similar. I appreciate it if you let me know what you think

Introduction

Here is my lighttpd config. It supports shortened URLs for the /files & /themes.


$SERVER["socket"] == ":80" {

###
# drupal specific stuff
###

# Deny access to backup_migrate module dumps
$HTTP["url"] =~ "^(/sites/(.*)/files/backup_migrate/)" {
    url.access-deny = ("")
}
$HTTP["url"] =~ "/files/backup_migrate/" {
    url.access-deny = ( "" )
}

###
# drupal vhosting
###

$HTTP["host"] =~ "(.*).example.com$" {

    ### default to drupal 7
    server.document-root = "/local/www/drupal-7/"

My lighttpd server is serving both a Drupal based dynamic content website and a static content website. On the dynamic website Garret Albright's LUA script at: http://groups.drupal.org/node/22787 works like a charm.

But on the static website it seems to cause Lighttpd to ignore the configuration file directive:

I wasn't happy with the vhost modules in lighttpd, I host a few drupal sites on a multisite setup, as well as a few non-drupal sites, so a single way of defining vhosts was a bit too restrictive. I came up with a script which is loaded by include_script, based on this howto. I'm using the mod_magnet script from here.

Hi, Im not Nginx user, but I need to ask before setting up nginx for my drupal website

I need to have my domain.tld running, which means in the domain.tld folder is Drupal installation.

So I will see my website when I browse http://www.domain.tld/

But I have a folder with name "app1" which contains another Drupal installation.

So I will see another Drupal installation when I browse http://www.domain.tld/app1/

I dont want to setup subdomain because this way is far easier and dont need other codes in config file.

This works fine in Apache2, but not works in lighttpd

Be wary of what folks can upload into the "files" directories on your Drupal site. They may be able to upload a PHP file, then try to access that PHP file in their web browser, thus being able to execute arbitrary code. This is dangerous!

I believe Drupal's .htaccess files block this sort of thing for Apache users, but what about us Lighty users? Fortunately, it's not too tough to stop this from happening; just add something like this to Lighty's config file:

I am currently running a multisite installation with Drupal 6.13 on Lighttpd 1.4.19 and facing issues when creating Drupal sites in subdirectories.
After reading through countles posts here on the drupal sites, as well on lighttpd I am close to converting back to Apache as I can't get this to work.
The drupal directory structure looks like this

Drupal root: /home/www/drupal/sites

+sites
|______all
|______default
|______domain.com
|______blogs.domain.com
|______blogs.domain.com.blog1
|______blogs.domain.com.blog2

For those looking to have Drupal serve private files efficiently, I've posted a simple core patch that adds X-Sendfile support:
http://drupal.org/node/74472