# ownCloud Administrators Manual

# Lighttpd Configuration

This assumes that you are familiar with installing PHP applications on Lighttpd.

It is important to note that the `.htaccess` used by ownCloud to protect the `data` folder is ignored by lighttpd, so you have to secure it by yourself, otherwise your `owncloud.db` database and user data are publicly readable even if directory listing is off. You need to add these two snippets to your Lighttpd configuration file:

Disable access to data folder:

    $HTTP["url"] =~ "^/owncloud/data/" {
            url.access-deny = ("")
    }

Disable directory listing:

    $HTTP["url"] =~ "^/owncloud($|/)" {
            dir-listing.activate = "disable"
    }

Note for Lighttpd users on Debian stable (wheezy):

Recent versions of ownCloud make use of the HTTP PATCH feature, which was added to Lighttpd at version 1.4.32 while Debian stable only ships 1.4.31. The patch is simple, however, and easy to integrate if you’re willing to build your own package.

Download the patch from http://redmine.lighttpd.net/attachments/download/1370/patch.patch

Make sure you have the build tools you need:

    apt-get build-dep lighttpd
    apt-get install quilt patch devscripts

Patch the package source:

    apt-get source lighttpd
    cd lighttpd-1.4.31
    export QUILT_PATCHES=debian/patches # This tells quilt to put the patch in
    the right spot
    quilt new http-patch.patch
    quilt add src/connections.c src/keyvalue.c src/keyvalue.h # Make quilt
    watch the files we'll be changing
    patch -p1 -i /patch/to/downloaded/patch.patch
    quilt refresh

Increment the package version with `dch -i`. This will open the changelog with a new entry. You can save as-is or add info to it. The important bit is that the version is bumped so apt will not try to “upgrade” back to Debian’s version.

Then build with `debuild` and install the .debs for any Lighttpd packages you already have installed.