rTorrent + ruTorrent Seedbox Setup Guide

Secure Your Environment

You likely know you shouldn't operate as root, whether you know why or not. If you want to know more, there are lots of resources. If you're starting from scratch, and this machine will be principally dedicated to rTorrent and ruTorrent, having a security hardened system likely isn't a major concern. But, if you're learning, you may as well learn with best practices in mind.

Create a new user:

adduser <username>

Install sudo:

apt-get install sudo

Install nano (may already be installed):

apt-get update && apt-get install nano

Open the super users list:

EDITOR=nano visudo

Add your username to grant yourself super user privileges:

# User privilege specification
root	ALL=(ALL:ALL) ALL
<username>	ALL=(ALL:ALL) ALL

Open SSH configuration for editing:

nano /etc/ssh/sshd_config

Let's edit the SSH configuration to make your server a little more secure. The following adjustments will...

• Change the default SSH port to make it more difficult for attackers to access.
• Disallow root login while only allowing your user account to login via SSH. An attacker would now have to guess the port and username.
• Turn off x11 forwarding and DNS for added security.

Modify the following lines in sshd_config:

Port <10001-65535>
PermitRootLogin no
X11Forwarding no

Add the following lines to the bottom of sshd_config:

UseDNS no
AllowUsers <username>

Restart SSH daemon:

service ssh reload

Open a new terminal and test logging in with your newly created user + modified SSH port. If it works, close the root session and continue with your new user account, if not, check settings in previous steps with the root terminal.

From now on, we will prepend sudo to many commands. This will execute the command with super user privileges, a requisite for modifying any files not owned by your user account.

Install Dependencies

Paste this entire line into the terminal to install each dependency.

sudo apt-get install -y build-essential subversion autoconf screen g++ gcc ntp curl comerr-dev pkg-config cfv libtool libssl-dev libncurses5-dev ncurses-term libsigc++-2.0-dev libcppunit-dev libcurl3 libcurl4-openssl-dev git

Install XML-RPC

From the project homepage:

"XML-RPC is a quick-and-easy way to make procedure calls over the Internet. It converts the procedure call into an XML document, sends it to a remote server using HTTP, and gets back the response as XML."

XML-RPC is required for communication between rTorrent and ruTorrent.

svn co -q https://svn.code.sf.net/p/xmlrpc-c/code/stable /tmp/xmlrpc-c
cd /tmp/xmlrpc-c
./configure --disable-libwww-client --disable-wininet-client --disable-abyss-server --disable-cgi-server
make -j2
sudo make install

In the commands above we've...

• downloaded and unpacked XML-RPC into its own temporary directory.
• configured XML-RPC while disabling features that we don't need for rtorrent/rutorrent.
• used the -j2 modifier for make, forcing it to recompile using two threads. If you have a dual- or quad-core CPU, you can increase this number to speed up the compiling process (to a degree).

Install LibTorrent

LibTorrent is the library on which the rTorrent client runs.

Before beginning this section, navigate to http://rakshasa.github.io/rtorrent/ in your browser to find the latest version of the library. Update the filename in the commands below to account for the version of LibTorrent you'd like to use. Make sure any communities you belong to have the torrent client you choose to use whitelisted.

cd /tmp
curl http://rtorrent.net/downloads/libtorrent-0.13.6.tar.gz | tar xz
cd libtorrent-0.13.6
./autogen.sh
./configure
make -j2
sudo make install

Install rTorrent

Just as with the previous section, navigate to http://rakshasa.github.io/rtorrent/ in your browser to find the latest version of the client. Update the filename in the commands below to account for the version of rTorrent you'd like to use. Make sure any communities you belong to have the torrent client you choose to use whitelisted.

cd /tmp
curl http://rtorrent.net/downloads/rtorrent-0.9.6.tar.gz | tar xz
cd rtorrent-0.9.6
./autogen.sh
./configure --with-xmlrpc-c
make -j2
sudo make install
sudo ldconfig

Make rTorrent directories and change their owner:

sudo mkdir -p /home/downloads/{.session,~watch}
sudo chown -R <username>:<username> /home/downloads

• The -p flag makes nested directories. I.e., it will create the directory downloads and nest .session and ~watch within it.
• The -R flag recursively applies chown to the target's subfolders.

Configure rTorrent

To configure rTorrent, you need to modify the file ~/.rtorrent.rc. You can either modify each line individually, or paste the preconfigured file provided below.

nano ~/.rtorrent.rc

# Maximum and minimum number of peers to connect to per torrent.
min_peers = 40
max_peers = 100

# Same as above but for seeding completed torrents (-1 = same as downloading)
min_peers_seed = 25
max_peers_seed = 60

# Maximum number of simultaneous uploads per torrent.
max_uploads = 30

# Global upload and download rate in KiB. "0" for unlimited.
#download_rate = 0
#upload_rate = 0

# Default directory to save the downloaded torrents.
directory = /home/downloads

# Default session directory. Make sure you don't run multiple instance
# of rtorrent using the same session directory. Perhaps using a
# relative path?
session = /home/downloads/.session

# Watch a directory for new torrents, and stop those that have been
# deleted.
schedule = watch_directory,5,5,load_start=/home/downloads/~watch/*.torrent

# Close torrents when diskspace is low.
schedule = low_diskspace,5,60,close_low_diskspace=10240M

# The ip address reported to the tracker.
#ip = 127.0.0.1
#ip = rakshasa.no

# The ip address the listening socket and outgoing connections is
# bound to.
#bind = 127.0.0.1
#bind = rakshasa.no

# Port range to use for listening.
port_range = 55950-56000

# Start opening ports at a random position within the port range.
port_random = yes

# Check hash for finished torrents. Might be usefull until the bug is
# fixed that causes lack of diskspace not to be properly reported.
check_hash = yes

# Set whether the client should try to connect to UDP trackers.
use_udp_trackers = yes

# Alternative calls to bind and ip that should handle dynamic ip's.
#schedule = ip_tick,0,1800,ip=rakshasa
#schedule = bind_tick,0,1800,bind=rakshasa

# Encryption options, set to none (default) or any combination of the following:
# allow_incoming, try_outgoing, require, require_RC4, enable_retry, prefer_plaintext
#
# The example value allows incoming encrypted connections, starts unencrypted
# outgoing connections but retries with encryption if they fail, preferring
# plaintext to RC4 encryption after the encrypted handshake
#
encryption = allow_incoming,enable_retry,prefer_plaintext

# Enable DHT support for trackerless torrents or when all trackers are down.
# May be set to "disable" (completely disable DHT), "off" (do not start DHT),
# "auto" (start and stop DHT as needed), or "on" (start DHT immediately).
# The default is "off". For DHT to work, a session directory must be defined.
#
dht = disable

# UDP port to use for DHT.
#
# dht_port = 6881

# Enable peer exchange (for torrents not marked private)
#
peer_exchange = no

scgi_port = 127.0.0.1:5000

cp ~/rtorrent-0.9.6/doc/rtorrent.rc ~/.rtorrent.rc
nano ~/.rtorrent.rc

directory = /home/downloads
session = /home/downloads/.session
schedule = watch_directory,5,5,load_start=/home/downloads/~watch/*.torrent
schedule = low_diskspace,5,60,close_low_diskspace=10240M
port_range = 55950-56000
port_random = yes
check_hash = yes
use_udp_trackers = yes
encryption = allow_incoming,enable_retry,prefer_plaintext
dht = disable
peer_exchange = no
scgi_port = 127.0.0.1:5000

Let's check to make sure rTorrent starts.

rtorrent

You won't anything interesting; if it opens, we're good to go.
Close rTorrent by pressing Ctrl+Q.

Next, we'll start rTorrent in a screen session that will allow it to continue running in the background.

screen -S rtorrent -fa -d -m rtorrent

What do those modifiers mean?

• -S rtorrent Screen session name: rtorrent
• -d -m Start screen in detached mode; exit if session terminates
• -fa Flow control: automatic

Automatically Start rTorrent on System Boot

It's inconvenient to have to start rTorrent manually every time the server restarts. We can make it start automatically upon reboot by using a bash script.

sudo nano /etc/init.d/rtorrent

Paste the contents of this file into the terminal. Many thanks to Greg Methvin for the original script, and Max Power for the fork designed to work specifically with ruTorrent and XML-RPC.

#!/bin/bash
### BEGIN INIT INFO
# Provides:          rtorrent
# Required-Start:    $local_fs $remote_fs $network $syslog
# Required-Stop:     $local_fs $remote_fs $network $syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Start/stop rtorrent daemon
### END INIT INFO

# ------------------------------------------------------------------------------
# /etc/init.d/rtorrent
#
# This script is an init script to run rtorrent in the background, using a
# screen. The script was designed and tested for Debian systems, but may work on
# other systems. On Debian, enable it by moving the script to
# "/etc/init.d/rtorrent" and issuing the command
# "update-rc.d rtorrent defaults 99"
#    ____                _ _
#   / ___|  ___  ___  __| | |__   _____  __
#   \___ \ / _ \/ _ \/ _` | '_ \ / _ \ \/ /
#    ___) |  __/  __/ (_| | |_) | (_) >  <
#   |____/ \___|\___|\__,_|_.__/ \___/_/\_\
#
# @see http://methvin.net/scripts/rtorrent
# @see http://tldp.org/LDP/abs/html/
# ------------------------------------------------------------------------------

## Username to run rtorrent under, make sure you have a .rtorrent.rc in the
## home directory of this user!
USER="<username>"

## Absolute path to the rtorrent binary.
## run "which rtorrent"
RTORRENT="/usr/local/bin/rtorrent"

## Absolute path to the screen binary.
SCREEN="/usr/bin/screen"

## Name of the screen session, you can then "screen -r rtorrent" to get it back
## to the foreground and work with it on your shell.
SCREEN_NAME="rtorrent"

## Absolute path to rtorrent's PID file.
PIDFILE="/var/run/rtorrent.pid"

## Absolute path to rtorrent's XMLRPC socket.
SOCKET="/var/run/rtorrent/rpc.socket"

## Check if the socket exists and if it exists delete it.
delete_socket() {
if [[ -e $SOCKET ]]; then
rm -f $SOCKET
fi
}

case "$1" in
## Start rtorrent in the background.
start)
echo "Starting rtorrent."
delete_socket
start-stop-daemon --start --background --oknodo \
--pidfile "$PIDFILE" --make-pidfile \
--chuid $USER \
--exec $SCREEN -- -DmUS $SCREEN_NAME $RTORRENT
if [[ $? -ne 0 ]]; then
echo "Error: rtorrent failed to start."
exit 1
fi
echo "rtorrent started successfully."
;;

## Stop rtorrent.
stop)
echo "Stopping rtorrent."
start-stop-daemon --stop --oknodo --pidfile "$PIDFILE"
if [[ $? -ne 0 ]]; then
echo "Error: failed to stop rtorrent process."
exit 1
fi
delete_socket
echo "rtorrent stopped successfully."
;;

## Restart rtorrent.
restart)
"$0" stop
sleep 1
"$0" start || exit 1
;;

## Print usage information if the user gives an invalid option.
*)
echo "Usage: $0 [start|stop|restart]"
exit 1
;;

esac

Set permissions and install the init script.

sudo chmod +x /etc/init.d/rtorrent
sudo update-rc.d rtorrent defaults 99

Install Web Server Dependencies

For Ubuntu 16.4 LTS:

sudo apt-get install apache2 apache2-utils libapache2-mod-php

For Debian 8:

sudo apt-get install apache2 apache2-utils libapache2-mod-php5

Configure Apache

Enable auth_digest module for ruTorrent authentication, SSL, and reqtimeout.

sudo a2enmod auth_digest ssl reqtimeout

Open apache2.conf

sudo nano /etc/apache2/apache2.conf

Edit or add the following lines:

Timeout 30
ServerSignature Off
ServerTokens Prod

ServerTokens Prod will prevent Apache from reporting its version number, and ServerSignature Off will disable the server signature displayed in Apache error messages. Small steps to harden your system.

Restart Apache

sudo service apache2 restart

Now, let's confirm that Apache and PHP are working.

echo '<?php phpinfo(); ?>' | sudo tee /var/www/html/info.php

The previous command created a file called info.php in the web root containing the function phpinfo(), which, if everything is functioning properly, should print a large table of information detailing your server's PHP settings.

Open your browser and navigate to <server.address>/info.php

After confirming that PHP and Apache are working, remove info.php to avoid unnecessarily exposing information about your system.

sudo rm /var/www/html/info.php

Create an SSL Certificate

We'll create a self-signed SSL certificate that will allow you to access ruTorrent via the https:// protocol and will expire in 10 years.

sudo mkdir /etc/apache2/ssl
sudo openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.pem -out /etc/apache2/ssl/apache.pem

Fill in the fields as prompted, or leave them blank (excepting the CN field). Be sure to input something for the CN (Common Name) field. Typically this is your server's hostname, but if you have a domain pointed to your server, you may use that instead.

Now, change the permissions for the newly created certificate, as some programs will refuse to load these certificates if permissions are set wrong.

sudo chmod 600 /etc/apache2/ssl/apache.pem

Configure Apache Access

Open Apache's default configuration:

sudo nano /etc/apache2/sites-available/default

Modify as follows, or replace the whole document, to enable SSL on port 443 and to setup Auth Digest for the rutorrent directory:

<VirtualHost *:80>
ServerAdmin webmaster@localhost

DocumentRoot /var/www/html
<Directory />
  Options FollowSymLinks
  AllowOverride All
</Directory>
<Directory /var/www/html/>
  Options -Indexes FollowSymLinks MultiViews
  AllowOverride None
  Order allow,deny
  allow from all
</Directory>

ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
<Directory "/usr/lib/cgi-bin">
  AllowOverride None
  Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
  Order allow,deny
  Allow from all
</Directory>

ErrorLog ${APACHE_LOG_DIR}/error.log

# Possible values include: debug, info, notice, warn, error, crit, alert, emerg.
LogLevel warn

CustomLog ${APACHE_LOG_DIR}/access.log combined

<Location /rutorrent>
  AuthType Digest
  AuthName "rutorrent"
  AuthDigestDomain /var/www/html/rutorrent/ http://<server.address>/rutorrent
  AuthDigestProvider file
  AuthUserFile /etc/apache2/.htpasswd
  Require valid-user
  SetEnv R_ENV "/var/www/html/rutorrent"
</Location>
</VirtualHost>

<VirtualHost *:443>
ServerAdmin webmaster@localhost
ServerName <server.address>:443

SSLEngine on
SSLCertificateFile /etc/apache2/ssl/apache.pem

DocumentRoot /var/www/html/
<Directory />
  Options FollowSymLinks
  AllowOverride All
</Directory>
<Directory /var/www/html/>
  Options -Indexes FollowSymLinks MultiViews
  AllowOverride None
  Order allow,deny
  allow from all
</Directory>

ErrorLog ${APACHE_LOG_DIR}/error.log

# Possible values include: debug, info, notice, warn, error, crit, alert, emerg.
LogLevel warn

CustomLog ${APACHE_LOG_DIR}/access.log combined

<Location /rutorrent>
  AuthType Digest
  AuthName "rutorrent"
  AuthDigestDomain /var/www/html/rutorrent/ http://<server.address>/rutorrent
  AuthDigestProvider file
  AuthUserFile /etc/apache2/.htpasswd
  Require valid-user
  SetEnv R_ENV "/var/www/html/rutorrent"
</Location>
</VirtualHost>

Enable SSL for your site:

sudo a2ensite default-ssl

Modify Apache ports configuration:

sudo nano /etc/apache2/ports.conf

Modify ports.conf to include the line NameVirtualHost *:443, or just replace the whole file with this:

NameVirtualHost *:80
Listen 80

<IfModule mod_ssl.c>
NameVirtualHost *:443
Listen 443
</IfModule>

<IfModule mod_gnutls.c>
Listen 443
</IfModule>

Restart Apache

sudo service apache2 restart

Confirm that Apache and SSL are working by navigating to your server in a browser with the https:// prefix: https://<server.address>

You will likely receive a warning from your browser suggesting that the site is insecure. This is because of our self-signed certificate; ignore it and proceed.

You should see a page containing the text, "It works!" Or with new versions of Ubuntu, you'll see the "Apache2 Ubuntu Default Page."

Optional: Modify PHP Settings

If you ever find yourself uploading one or two dozen torrents at a time, you may want to adjust the PHP settings to allow for larger file uploads.

First, create a new phpinfo() file. There are other, quicker ways to find the active php.ini file, but this is a surefire method that won't leave you editing one of the inactive files.

echo '<?php phpinfo(); ?>' | sudo tee /var/www/html/info.php

Go to <server.address>/info.php in your browser.

Find the line that says Loaded Configuration file and then copy and paste its location in the following command, replacing the underlined string:

sudo nano /etc/php5/apache2/php.ini

Use Ctrl+W in Nano to find and modify the following lines:

upload_max_filesize = 64M
max_file_uploads = 200
post_max_size = 128M

Remove the file info.php to reduce security risks.

sudo rm /var/www/html/info.php

Restart Apache

sudo service apache2 restart

Install ruTorrent Dependencies

sudo apt-get install zip unzip zlib1g-dev ffmpeg mediainfo
sudo apt-get install unrar rar

sudo nano /etc/apt/sources.list

deb http://ftp.us.debian.org/debian jessie-backports main contrib non-free

sudo apt update && sudo apt install -t jessie-backports ffmpeg

sudo nano /etc/apt/sources.list

deb ftp://ftp.us.debian.org/debian/ wheezy non-free
deb http://security.debian.org/ wheezy/updates non-free

sudo apt-get update

sudo apt-get install unrar rar

Download ruTorrent

Download ruTorrent from the project's Github repository, remove the packaged plugins directory, then replace it with the plugins from the repository. The following commands will download the latest versions of ruTorrent and plugins. No need to find the latest versions like in previous steps.

cd /var/www/html
sudo git clone https://github.com/Novik/ruTorrent.git rutorrent
sudo rm -r rutorrent/plugins
sudo svn checkout https://github.com/Novik/ruTorrent/trunk/plugins rutorrent/plugins

Configure ruTorrent

Transfer ownership of rutorrent files to webserver so that they are accessible:

sudo chown -R www-data:www-data rutorrent
sudo chmod -R 755 rutorrent

Edit the ruTorrent configuration file:

sudo nano rutorrent/conf/config.php

	$log_file = '/tmp/rutorrent_errors.log';
	$topDirectory = '/home/downloads/';
	$pathToExternals = array(
		"php" => '/usr/bin/php',
		"curl" => '/usr/bin/curl',
		"gzip" => '/bin/gzip',
		"id" => '/usr/bin/id',
		"stat" => '/usr/bin/stat',
	);

Those modifications...

• Changed the error log filename to differentiate it from other error logs.
• Restricted the ruTorrent interface to /home/downloads.
• Defined the paths to ruTorrent dependencies.

Configure ruTorrent Plugins

ruTorrent has extended functionality beyond basic interface with rTorrent via a robust set of plugins. The plugins.ini file allows you to either hardcode an on/off state for individual plugins, or set them as user-defined, which allows you to determine their state within the ruTorrent web GUI.

This alphabetized version of plugins.ini enables all of the (subjectively) most useful plugins, and the additional optional plugins you can choose to install later in this guide. Enable/disable plugins as you see fit (the more plugins enabled, the longer ruTorrent will take to load), and if you don't know what something does, leave it set as user-defined, and explore the features in the web GUI.

sudo rm -f /var/www/html/rutorrent/conf/plugins.ini
sudo nano /var/www/html/rutorrent/conf/plugins.ini

;; Plugins permissions.
;; If flag is not found in plugin section, corresponding flag from "default" section is used.
;; If flag is not found in "default" section, it is assumed to be "yes".
;;
;; For setting individual plugin permissions you must write something like that:
;;
;; [ratio]
;; enabled = yes ;; also may be "user-defined", in this case user can control plugins state from UI
;; canChangeToolbar = yes
;; canChangeMenu = yes
;; canChangeOptions = no
;; canChangeTabs = yes
;; canChangeColumns = yes
;; canChangeStatusBar = yes
;; canChangeCategory = yes
;; canBeShutdowned = yes

[default]
enabled = user-defined
canChangeToolbar = yes
canChangeMenu = yes
canChangeOptions = yes
canChangeTabs = yes
canChangeColumns = yes
canChangeStatusBar = yes
canChangeCategory = yes
canBeShutdowned = yes



[_getdir]
enabled = yes

[_task]
enabled = yes

[autotools]
enabled = user-defined

[chat]
enabled = no

[check_port]
enabled = no

[chunks]
enabled = user-defined

[cookies]
enabled = user-defined

[cpuload]
enabled = user-defined

[create]
enabled = user-defined

[data]
enabled = user-defined

[datadir]
enabled = yes

[diskspace]
enabled = user-defined

[edit]
enabled = user-defined

[erasedata]
enabled = user-defined

[extratio]
enabled = user-defined

[extsearch]
enabled = user-defined

[feeds]
enabled = no

[filedrop]
enabled = user-defined

[filemanager]
enabled = yes

[fileshare]
enabled = yes

[geoip]
enabled = user-defined

[history]
enabled = no

[httprpc]
canBeShutdowned = no

[instantsearch]
enabled = no

[ipad]
enabled = user-defined

[logoff]
enabled = yes

[loginmgr]
enabled = no

[mediainfo]
enabled = yes

[mediastream]
enabled = yes

[pausewebui]
enabled = yes

[ratio]
enabled = user-defined

[ratiocolor]
enabled = user-defined

[retrackers]
enabled = no

[rpc]
enabled = no

[rss]
enabled = user-defined

[rssurlrewrite]
enabled = no

[rutracker_check]
enabled = no

[scheduler]
enabled = user-defined

[screenshots]
enabled = yes

[seedingtime]
enabled = yes

[show_peers_like_wtorrent]
enabled = user-defined

[source]
enabled = yes

[theme]
enabled = yes

[throttle]
enabled = user-defined

[titlebar]
enabled = user-defined

[tracklabels]
enabled = user-defined

[trafic]
enabled = user-defined

[unpack]
enabled = user-defined

Create ruTorrent Credentials

Now let's create a username/password for ruTorrent. This is a different set of credentials than the SSH user account we created at the beginning of this process. It's more secure to pick different credentials than those you chose previously, but less convenient. It's your choice.

sudo htdigest -c /etc/apache2/.htpasswd rutorrent <username>

Status Report

You've now completed all the steps to run rTorrent and ruTorrent on your server. You can stop here, or add additional functionality to ruTorrent or to your server, like the ability to stream media to your local devices, and automatically download torrents that match custom filter rules.

Before we go any further, verify that everything is working as expected. It's easier to fix problems now with fewer components to troubleshoot.

Navigate to https://<server.address>/rutorrent

Make sure the GUI loads, and then try adding a torrent.

Apache Error Logs

Debian/Ubuntu: /var/log/apache2/error.log

CentOS: /var/log/httpd/error_log

rTorrent won't start after reboot

If you find that rtorrent will not start on reboot, try to start rtorrent manually:

rtorrent

You'll likely get the following error:

rtorrent: Could not lock session directory: "/home/downloads/.session/", held by "<server.address>:+XXXX".

This can happen if your system crashes, or if you run out of disk space. To resolve the issue, delete rtorrent.lock from the session directory.

sudo rm -f /home/downloads/.session/rtorrent.lock

Now rtorrent should start, and you can reboot or start a new screen session for rtorrent:

screen -S rtorrent -fa -d -m rtorrent