Howto restrict IPv6 listening address in lighttpd on Debian

Question

I try to make a lighttpd only available from localhost on a Debian system. The following lines are in /etc/lighttpd/lighttpd.conf

server.port = 80
server.bind = "127.0.0.1"
server.use-ipv6 = "disable"

However, the webserver is running on all IPv6 addresses, too:

# netstat -tupan|grep lighttpd
tcp        0      0 127.0.0.1:80            0.0.0.0:*               LISTEN      519887/lighttpd     
tcp6       0      0 :::80                   :::*                    LISTEN      519887/lighttpd    

With the following line instead of the formerly printed lines in the config file, the server won't start:

server.bind = "[::1]"

It means, I've got only an error message about a used port, but the port ist not used!

# netstat -tupan|grep LISTEN|grep 80/; lighttpd -f /etc/lighttpd/lighttpd.conf; netstat -tupan|grep LISTEN|grep 80/
2023-04-27 16:50:24: (network.c.537) can't bind to socket: [::1]:80: Address already in use

How I can restrict lighttpd to listen only on localhost (only IPv4, only IPv6 or IPv4 and IPv6)

Answer 1

Since your lighttpd.conf is Debian-based, the default /etc/lighttpd/lighttpd.conf contains:

include_shell "/usr/share/lighttpd/use-ipv6.pl " + server.port

You should comment out that line to stop lighttpd listening on IPv6

#include_shell "/usr/share/lighttpd/use-ipv6.pl " + server.port

If you still want to make lighttpd only available from localhost on IPv6, add

$SERVER["socket"] == "[::1]:80" { }

Answer 2

Or, if you cannot rely on the changes of the /etc/lighttpd/lighttpd.conf you can change the use-ipv6.pl script ...

cat <<EOF > /usr/share/lighttpd/use-ipv6.pl
#! /bin/bash
sleep 1
EOF

and make it executable ...
chmod +x /usr/share/lighttpd/use-ipv6.pl