I have installed BitTorrent Sync on my Ubuntu server, but noticed that the web gui does not use ssl for login (https://server:8888/gui does not work, however http://server:8888/gui does). This is both for logging in and using the gui while logged in.

Is there any way to force it to use ssl instead?

  • 1
    Will try to follow this guide to achive this. – Gedrox Oct 17 '14 at 17:48
up vote 5 down vote accepted

Easy way

Use btsync configuration to achieve this, see ./btsync --dump-sample-config configuration keys "force_https", "ssl_certificate", "ssl_private_key".

Even this seems simpler, I don't like that btsync user has access to certificate files. That's why I still prefer the next method.

Hard way

I found the solution in cyberciti.biz/faq/howto-linux-unix-setup-nginx-ssl-proxy using nginx as proxy server. Successfully installed and configured on my ubuntu server installation.

Further steps assume that you have created SSL certificates in directory /etc/nginx/certs/ (ssl.crt and ssl.key).

Install nginx

sudo apt-get install nginx

(Optional) Deactivate default configuration

sudo rm /etc/nginx/sites-enabled/default

Create proxy configuration in /etc/nginx/sites-available/proxy with contents

server {
    ### server port and name ###
    listen          443;
    ssl             on;
    server_name     your-server-name.com;

    ### SSL log files ###
    access_log      /var/log/nginx/ssl-access.log;
    error_log       /var/log/nginx/ssl-error.log;

    ### SSL cert files ###
    ssl_certificate      /etc/nginx/certs/ssl.crt;
    ssl_certificate_key  /etc/nginx/certs/ssl.key;

    ### Add SSL specific settings here ###

    ssl_protocols        SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers RC4:HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    keepalive_timeout    60;
    ssl_session_cache    shared:SSL:10m;
    ssl_session_timeout  10m;

    ### We want full access to SSL via backend ###
    location / {
            proxy_pass  http://{destination-host}:{destination-port};

            ### force timeouts if one of backend is died ##
            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;

            ### Set headers ####
            proxy_set_header        Accept-Encoding   "";
            proxy_set_header        Host            $host;
            proxy_set_header        X-Real-IP       $remote_addr;
            proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;

            ### Most PHP, Python, Rails, Java App can use this header ###
            #proxy_set_header X-Forwarded-Proto https;##
            #This is better##
            proxy_set_header        X-Forwarded-Proto $scheme;
            add_header              Front-End-Https   on;


            ### By default we don't want to redirect it ####
            proxy_redirect     off;
  }

}

Change values your-server-name.com, {destination-host}, {destination-port} and other values accordingly.

Enable the configuration

sudo ln -s /etc/nginx/sites-available/proxy /etc/nginx/sites-enabled/proxy  

Restart nginx

sudo service nginx restart
  • Oh, nice. Thank you! And I do agree - giving btsync access to the key isn't too nice... – lindhe Oct 18 '14 at 19:42
  • The proper way would be to have the sync GUI listen on localhost:8888. With this proxy config the web GUI will still be available encrypted on port 8888. – Danie Apr 16 '15 at 4:48
  • You mean "the web GUI will still be available not encrypted on port 8888"? – Gedrox Apr 16 '15 at 9:57

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.