5

I have installed BitTorrent Sync on my Ubuntu server, but noticed that the web gui does not use ssl for login (https://server:8888/gui does not work, however http://server:8888/gui does). This is both for logging in and using the gui while logged in.

Is there any way to force it to use ssl instead?

1
  • 1
    Will try to follow this guide to achive this.
    – Gedrox
    Oct 17, 2014 at 17:48

1 Answer 1

5

Easy way

Use btsync configuration to achieve this, see ./btsync --dump-sample-config configuration keys "force_https", "ssl_certificate", "ssl_private_key".

Even this seems simpler, I don't like that btsync user has access to certificate files. That's why I still prefer the next method.

Hard way

I found the solution in cyberciti.biz/faq/howto-linux-unix-setup-nginx-ssl-proxy using nginx as proxy server. Successfully installed and configured on my ubuntu server installation.

Further steps assume that you have created SSL certificates in directory /etc/nginx/certs/ (ssl.crt and ssl.key).

Install nginx

sudo apt-get install nginx

(Optional) Deactivate default configuration

sudo rm /etc/nginx/sites-enabled/default

Create proxy configuration in /etc/nginx/sites-available/proxy with contents

server {
    ### server port and name ###
    listen          443;
    ssl             on;
    server_name     your-server-name.com;

    ### SSL log files ###
    access_log      /var/log/nginx/ssl-access.log;
    error_log       /var/log/nginx/ssl-error.log;

    ### SSL cert files ###
    ssl_certificate      /etc/nginx/certs/ssl.crt;
    ssl_certificate_key  /etc/nginx/certs/ssl.key;

    ### Add SSL specific settings here ###

    ssl_protocols        SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers RC4:HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    keepalive_timeout    60;
    ssl_session_cache    shared:SSL:10m;
    ssl_session_timeout  10m;

    ### We want full access to SSL via backend ###
    location / {
            proxy_pass  http://{destination-host}:{destination-port};

            ### force timeouts if one of backend is died ##
            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;

            ### Set headers ####
            proxy_set_header        Accept-Encoding   "";
            proxy_set_header        Host            $host;
            proxy_set_header        X-Real-IP       $remote_addr;
            proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;

            ### Most PHP, Python, Rails, Java App can use this header ###
            #proxy_set_header X-Forwarded-Proto https;##
            #This is better##
            proxy_set_header        X-Forwarded-Proto $scheme;
            add_header              Front-End-Https   on;


            ### By default we don't want to redirect it ####
            proxy_redirect     off;
  }

}

Change values your-server-name.com, {destination-host}, {destination-port} and other values accordingly.

Enable the configuration

sudo ln -s /etc/nginx/sites-available/proxy /etc/nginx/sites-enabled/proxy  

Restart nginx

sudo service nginx restart
3
  • Oh, nice. Thank you! And I do agree - giving btsync access to the key isn't too nice...
    – lindhe
    Oct 18, 2014 at 19:42
  • The proper way would be to have the sync GUI listen on localhost:8888. With this proxy config the web GUI will still be available encrypted on port 8888.
    – Danie
    Apr 16, 2015 at 4:48
  • You mean "the web GUI will still be available not encrypted on port 8888"?
    – Gedrox
    Apr 16, 2015 at 9:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .