Subsy's Seedbox Setup Guide

Changelog:
- April 3rd 2010: Original version
- April 4th 2010: Minor Bugfixes
- April 5th 2010: Added FTP setup instructions
- April 13th 2010: Added multiple user setup instructions (optional)
- April 17th 2010: Fixed bug in Pure-FTPd setup instructions


Introduction

This guide will walk you through a full install of a secure seedbox environment, running rtorrent with the rutorrent web front end and the pureftpd FTP server.
The guide also includes optional steps to configure for multiple users, each with their own web login and running instance of rtorrent.

Pre-requisites: An Ubuntu 9.10 or later server (should also work on some earlier versions, and on other Debian based distros, but this is untested) with root SSH access.

Basics

Initial login

Login to your server as root via SSH



(You can also use an SSH client if you prefer, eg PuTTY on Windows)

Type the password as requested

Create a new user that we’ll install everything with

For security purposes, we’re going to add a new user and disable SSH access for the root user



Replace <username> with a username of your choosing.
Fill in all the details when prompted (e.g. password)

Add your new user to the sudoers file. This allows this user to use elevated privileges when needed to do things that normally only the root user could do.



In recent versions of Ubuntu this opens the sudoers file for editing in a lightweight editor called nano.

Scroll down and find this line:



On the next line add:



Replace <username> with the username we created earlier.

Hit CTRL-O to save the file (and hit Enter to confirm when prompted), then hit CTRL-X to exit the editor.

Lock down SSH

Now we will change some SSH settings.
We're going to use a different port, and prevent root access via SSH



Change the following lines as below.
Use a high port of your choosing. I recommend a port over 20000



Then add these lines at the end of the file:



(As usual, replace <username> with the name of the user you created)

Hit CTRL-O to save the file (and hit Enter to confirm when prompted), then hit CTRL-X to exit the editor.

Now restart the SSH daemon



Log out of SSH and log back in as the new user you created earlier



(Note the -p argument which specifies the new SSH port that you configured in the last step)

Type the password as requested

Update packages

Ok, now we're going to make sure our Ubuntu installation is up to date.



This will update the package database with all the latest packages available. Using the sudo command will temporarily elevate your privileges to be able to execute these commands that normally only a super user could execute.



This will upgrade any packages that are out of date on your install.

Install necessary basic packages

Ok, now lets install some important packages that we're going to need throughout this guide:



Configure Apache

Basic configuration

We need to configure the Apache web server with some modules that we’ll need:



We want to edit our apache conf file for scgi support which is used to communicate with the rutorrent web front end.



Add this line at the end:



Hit CTRL-O to save the file (and hit Enter to confirm when prompted), then hit CTRL-X to exit the editor.

Reboot the server



After a few minutes, log back in via SSH



Lets just check apache is up and running

Open a browser and go to



You should see this message:



Configure Apache for HTTPS and password protection

We are going to create an SSL certificate so that we can access the server via https



This will create a self-signed certificate for your server that lasts for 1 year. You'll be prompted for a lot of of information. Whenever you're asked for a name, use your domain name if you have one. The rest you can leave blank or fill in with whatever you like.

Now lets add password protection



Where <webusername> is the username you'll use to connect to the rutorrent web UI.
It can be the same as the system username you’ve created previously if you like.
After running this command, you'll be prompted for a password. This will be the password you enter to log into the rutorrent web UI.



Now copy the following and paste to replace the contents of the file we're editing.
Then replace all instances of <servername or IP> with your real servername or IP



Now lets configure apache for HTTPS



And now lets reload Apache



Check that everything is working by opening a browser and going to:



You should see this message:



Webmin

I like to use Webmin for web based administration of my servers. It offers a very convenient way to remotely administer your server from anywhere with a net connection and a web browser.

First lets add the webmin repository to our sources.list file so that we can use apt to install is easily



Add this line to the end of the file:



Hit CTRL-O to save the file (and hit Enter to confirm when prompted), then hit CTRL-X to exit the editor.

Lets now fetch and install the PGP key for this new repository so we're not warned about it



Now we can install webmin



Test webmin is working by opening a browser and going to:



Login with the system user you created earlier

We will return to use Webmin later for an easy way to configure the Linux IPTables firewall

rtorrent

Ok, now lets install rtorrent

Building rtorrent from source

You can install rtorrent using apt, but the package there isn’t compiled with xmlrpc-c, which we need to use with rutorrent.
So we're going to compile our own version of rtorrent using xmlrpc-c



Now we’ll configure and make xmlrpc-c



Now time to do the same for libtorrent and rtorrent



Configuring rtorrent

Ok, now we've got rtorrent installed, but we have to configure it.

rtorrent needs a config file to initialize it. Heres mine...you'll need to edit it for your own environment, and make sure that the paths all exist and are writable by the user you will run rtorrent with.



The file should be saved in the home directory of the user you will run rtorrent with. I use the same system user we created earlier



Paste your config into that file

Hit CTRL-O to save the file (and hit Enter to confirm when prompted), then hit CTRL-X to exit the editor.

Ensure that the correct directories exist as you specified in the .rtorrent.rc file



Now check your config file is ok by trying to start rtorrent



If rtorrent starts, you're good. Use CTRL-Q to quit it.
If rtorrent doesnt start and you get an error, then note the error and fix your config file as necessary.

rtorrent startup script

Since we dont want to have to start rtorrent manually every time the server boots, we're going to start it automatically, and we'll run it in a screen session.

Now we'll create the startup script

Edit this example as necessary to change the username that you want rtorrent to run as.



Paste your edited config into that file



Hit CTRL-O to save the file (and hit Enter to confirm when prompted), then hit CTRL-X to exit the editor.

Now we need to change the user and group ownership of that file and make it executable



Now lets tell ubuntu to run this script at startup



Test the script:



Check that an rtorrent and a screen process are running using htop



To exit htop, hit F10

rutorrent

Ok, now to install rutorrent

ruTorrent is really just a set of php and html files, so we're going to install them to a folder under our web server root.
We’re going to get the latest 3.0 files from the subversion repository.



Now we'll download some useful rutorrent plugins



Now lets change ownership of the rutorrent files to the web server user, and change the permissions on them



OK, now visit your rutorrent site to check its all working:



You should be prompted for the username and password we set up earlier for password protection of our web server

Now you should see the rutorrent web gui, and be able to add torrents.

FTPS / SFTP

If you just want to use SFTP (FTP over SSH), you dont need to do anything more here.
Just connect with an FTP client via SFTP to your server on the SSH port you use.

If you want to setup FTPS (FTP using SSL encryption) then we'll setup Pure-FTPd.
I usually use proftpd on my servers but a bug in the current versions (1.3.2 in the Ubuntu karmic package repo, and 1.3.3 current stable) mean that a 550 error is thrown when browsing directories with '[' in their name.

Pure-FTPd



Now lets create another SSL certificate (you could use the ones you created earlier if you like - I prefer to keep them separate)



This will create a self-signed certificate for your server that lasts for 1 year. You'll be prompted for a lot of of information. Whenever you're asked for a name, use your domain name if you have one. The rest you can leave blank or fill in with whatever you like.

Now lets edit the Pure-ftpd config.
Pure-ftpd doesn't use a config file like other FTP daemons. Instead it starts with a set of command like switches.
However, the init.d startup script that is installed when you installed the pureftpd package can parse a directory of single line 'config files' in order to dynamically build the correct set of command line switches.
So all we need to do is create these single line files in the right place:

Temporarily act as root user



Enter the root password when asked



The first 'echo' line above creates a file that tells Pure-ftpd to use a particular port, so change the number to the port you wish to use.
The second 'echo' line creates a file that tells Pure-ftpd to use the given static IP address for Passive mode. You need to set this to the IP of your server.
The third 'echo' line determines what port range to use for Passive mode.
The fourth 'echo' line dictates which TLS mode to use. If you only want to permit encrypted data and control channel connections, you could set this to 3

If you want additional security, also do the following:



The first two 'echo' lines create files that stop users reading and writing system files that have a leading '.' in their filename (for example the '.rtorrent.rc' config file.
The third 'echo' line creates a file that stops users changing the permissions on files and folders.
The final 'echo' line creates a file that prevents clients that dont strictly adhere to the FTP/FTPS protocol from connecting.

Now lets configure how users will authenticate



Here we are configuring to use system usernames.

Now just restart the FTP service



Test everything is ok by connecting to the FTP service with an FTP client set to use the FTPS protocol, on the port you chose.

and return to the normal user



OPTIONAL: Multi-user setup

This section is OPTIONAL. If you want a multi-user setup, follow these steps.
This will show you how to add one additional user, but just use the same steps to add more as needed.
Each user will be set up as a system user, with only basic priveleges, without shell access.
They would use their system credentials to access FTP.
They will use a separate username/password combination to access the rutorrent web GUI.

Create new system users

Lets add our new user to the system



Replace <second_username> with a username of your choosing.
Fill in all the details when prompted (e.g. password)

Apache config

Now we want to edit our apache conf file to ensure that each user has their own SCGI mount point and port.



Find this line at the end:



and add a new line for the new user:



Note that the first user uses an SCGI mount point at /RPC2, on port 5000.
The second user uses an SCGI mount point at /RPC3, on port 5001

Hit CTRL-O to save the file (and hit Enter to confirm when prompted), then hit CTRL-X to exit the editor.

And now lets reload Apache



We also need to add a second user to our passwords file that protects the rutorrent web directory



This <second_webusername> can be whatever you like, but I recommend using the same name as previously used for <second_username>
After running this command, you'll be prompted for a password. This will be the password you enter to log into the rutorrent web UI.

rtorrent config and startup

Each user needs to run their own instance of rtorrent. Each instance of rtorrent needs its own config file.
So we need to copy our previously created .rtorrent.rc config file and edit it specifically for this user



Replace <second_username> with the username you chose previously.
Now lets edit that file and make some key changes



Find the following lines:



and change them for the new users config:



The port range needs to be different to the current users, and the scgi port also needs to be different to the current users.
If adding more users, ensure that each user has their own scgi port and torrent port range.
IMPORTANT: THESE PORTS MUST CORRESPOND TO THE PORTS CONFIGURED IN THE PREVIOUS STEP WHEN EDITING THE 'apache2.conf' FILE

Also find the following lines



and change them to:



Hit CTRL-O to save the file (and hit Enter to confirm when prompted), then hit CTRL-X to exit the editor.

We now need to make sure the relevant directories exist



We also need to make sure that the new users rtorrent starts up when the server is rebooted.
Lets copy our current users startup script and set it to run at boot.



Now lets make a change to the startup script to make sure that it runs as the corrent user



Find the line that configures which user to run the script as:



and change it to run as the new user we created:



If adding more users, ensure that each user has their own unique rtorrent startup script.

Hit CTRL-O to save the file (and hit Enter to confirm when prompted), then hit CTRL-X to exit the editor.

rutorrent config

Ok, now we need to configure rutorrent for multiple users.
To do this we need to create a configuration directory for each user that will hold that users config files.
Remember the SCGI mounts and ports weve configured? We'll need those details here.

user1 = <webusername> and his SCGI mount is on /RPC2 and port 5000
user2 = <second_webusername> and his SCGI mount is on /RPC3 and port 5001

Now we need to create the user conf directories and copy the config files to them



Now, we need to copy a file from the current default conf directory to each users specific conf directory.



Lets edit the ownership and permissions on these files



Now we need to edit each config file specific to each user.
In fact, we dont need to edit the config file for our first user (<webusername>) since that user is just going to use the config we had already setup for the single user system.
So we just need to edit the config file for the second user (<second_webusername>).



Find the following lines:



and change them to:



Hit CTRL-O to save the file (and hit Enter to confirm when prompted), then hit CTRL-X to exit the editor.

Remember, if you have more than 2 users you need to do this for each users unique config.php file and ensure the values for mount point and port match those set in previous steps when configuring rtorrent and apache

Now when you browse to



you will be prompted with the login dialog.
Depending on what username and password you enter here, your rutorrent instance will connect to the relevant rtorrent session.

Pure-FTPd

Ok, lets make a couple of changes to our Pure-ftpd setup to support multiple users

Temporarily act as root user



Enter the root password when asked



The first 'echo' line creates a file that stops users from navigating outside of their home directory.
The second 'echo' line creates a file that dictates how many connections can be made per connecting IP. Change this to whatever you deem appropriate for your needs.
The third 'echo' line creates a file that dictates how many connections in total can be made. Change this to whatever you deem appropriate for your needs.

Now return to the normal user



We have each users torrent downloads being stored in /home/downloads/<the_username>.
But in the steps above we've jailed each FTP user to not be able to leave their home directory /home/<the_username/
So we want to create a link from the users home directory to their downloads directory.
However, a symbolic link wont work here as the chroot will prevent it.
Instead we need to create mount points.
We can do this using:



However we want these mounts to be permanent so we do the following:



At the end of the file add these lines



Hit CTRL-O to save the file (and hit Enter to confirm when prompted), then hit CTRL-X to exit the editor.

And thats the end of the multi-user setup!

Linux Firewall

Right, we’re almost done, but first its time to set up the linux firewall to close all the ports other than the ones we need.

Its easiest to use Webmin for this task

Open a browser window and go to:



You'll need to login with the system username we created earlier

On the left hand navigation menu, go to Networking->Linux Firewall

Set up the firewall as you need..Remember that we need to open the following ports that we've configured in this guide:

SSH: 21976
FTPS: 22005
Passive Ports for FTP: 27200 to 27210
SSL: 443
Webmin: 10000
rtorrent: 55995 to 56000 for <username>, and 56001 to 56005 for <second_username>

And we can lock the rest down.

You're encouraged to change the ports used as examples in this guide - just make sure you write them down, and double check them before implementing any firewall rules.
You should also check with your host in case that they use any automatic network monitoring tools.
If they do, you may need to leave some ports open to respond to pings and so on, otherwise their tools might think your server is down and try rebooting it or putting it into recovery mode. Best just to check with them.

Summary

That’s it, we’re done !

no worries...

Added FTP setup steps

Changed FTP setup to use pure-ftpd and added optional section to configure for multi-users

Cool mate! Ill defenitely try out your setup when I get the chance, very awesome guide

Updated with a correction in the Pure-FTPd setup instructions

To me this would be a simpler way checkout rutorrent and get all plugins unless you are only wanting a few plugin which I don't understand why you would want that.

Thats fine if you want all the rutorrent plugins.

I don't because some of them simply arent needed, and each plugin imparts a performance hit.

The guide is intended to be a starting point for everyone to tweak and customize per their own unique needs.