[APKG] BitTorrent Sync

BitTorrent Sync is a proprietary peer-to-peer file synchronization tool available for Windows, Mac, and Linux.

Moderator: Lillian.W@AST

Post Reply
User avatar
clinton.hall
Posts: 845
youtube meble na wymiar Warszawa
Joined: Thu May 09, 2013 7:01 pm
Location: New Zealand
Contact:

Re: [APKG] BitTorrent Sync

Post by clinton.hall »

hmmm... it should be running.

What happens if you try to access [url]http://<ipaddress>:5555[/url]
or
[url]http://<ipaddress>:5555/gui[/url]
or
[url]http://<ipaddress>:5555/gui/en/index.html[/url]

do all give the same error? or do some give different responses?
AS-604T
3 x ST4000DM0000 (Seagate 4TB) in Raid5
2 GB RAM expansion
AS-302T

Apps (user)
NZBGet - CouchPotato - SickBeard - Git - Python

Apps (maintainer):
NZBGet - BitTorrent Sync - Mylar - LazyLibrarian - Gamez
-Maintenance of Apps acquired from JohhnyFive since ADM2.0:
SABnzbd - CouchPotato - SickBeard - HeadPhones - Subsonic

About Me: http://fockwulf.wix.com/index
damien599901
Posts: 575
Joined: Mon Dec 30, 2013 2:53 am

Re: [APKG] BitTorrent Sync

Post by damien599901 »

the problem concerns the browser !
this message of error apears with chrome 33.0.1750.70 beta on Mac
bitTorrent Sync works with safari and mozilla firefox
thanks Clinton
Storage: AS7004T & AS5002T
Network: FREEBOX REVOLUTION V6
Laptop: Apple MACBOOK Pro OS X El Capitan & Windows 10
Media Player: ASUSTOR NAS with Kodi 16 Beta & HD_Engine 1 (thanks Fathe_Mande)
Portable: iPhone 6S Plus, iPad Mini 2 & iPad Air
liefde
Posts: 56
Joined: Sat Feb 08, 2014 12:05 am

Re: [APKG] BitTorrent Sync

Post by liefde »

clinton.hall wrote:
liefde wrote: So how does a NAS-admin get there?
Well based on your previous comment the entire NAS is exposed and insecure... So accessing this file should be pretty easy.
Sure, if you mean to access shell for everything you want to do. But that's ludicrous, it's even MORE reason to NOT be using ADM anymore. Why would you? Why would anyone? It's horribly insecure.

And by the way, ssh access as root. Really. With the admin passwd. On the standard ssh port. For crying out loud. I hope all users get to sue Asustor because they got infected with crypt(o)locker or something, they deserve it. These devices should be forbidden to dump on the world as if they're secure.

I check such things for a living, and seeing how insecure ADM is makes me want to cry.
User avatar
Kapitein Haak
Posts: 333
Joined: Tue Oct 15, 2013 2:40 pm
Location: Stranded on the Dutch coast.

Re: [APKG] BitTorrent Sync

Post by Kapitein Haak »

liefde wrote: Sure, if you mean to access shell for everything you want to do. But that's ludicrous, it's even MORE reason to NOT be using ADM anymore. Why would you? Why would anyone? It's horribly insecure.

And by the way, ssh access as root. Really. With the admin passwd. On the standard ssh port. For crying out loud. I hope all users get to sue Asustor because they got infected with crypt(o)locker or something, they deserve it. These devices should be forbidden to dump on the world as if they're secure.

I check such things for a living, and seeing how insecure ADM is makes me want to cry.
ADM supports ssh, secure shell. Just below the option to activate ssh is the option to change the portnumber. If changing the port number there isn't to your liking, you could always choose a different port number for portforwarding on your router. Keeping the default username of root and admin is not the most secure, but with a decent password you should be OK.

If you want it really secure, disable remote access from the internet by not forwarding a port to the NAS ssh port. Problem solved, you will only be able to shell into the NAS from the security of your private network.

You could even use the VPN server of ADM 2.1...

BR, Kapitein Haak.
"What would the world be like without Captain Hook?"
---
"Homo sapiens non urinat in ventum" (A wise man doesn't piss into the wind), only in Amsterdam:
https://www.google.nl/maps/@52.36289,4. ... 312!8i6656
liefde
Posts: 56
Joined: Sat Feb 08, 2014 12:05 am

Re: [APKG] BitTorrent Sync

Post by liefde »

http://www.cyberciti.biz/faq/how-can-i-log-in-as-root/

"remote root login over ssh session is disabled in most cases for security reasons. First, login as a normal user and then switch to root account using the su command"

http://security.stackexchange.com/quest ... a-password

"First of all, you must understand that user authentication is a different and separate process than the establishment of the secure channel. In laymans terms what this means is that first, the public key of the server is used (if accepted!) to construct the secure SSH channel, by enabling the negotiation of a symmetric key which will be used to protect the remaining session, enable channel confidentiality, integrity protection and server authentication."
User avatar
Kapitein Haak
Posts: 333
Joined: Tue Oct 15, 2013 2:40 pm
Location: Stranded on the Dutch coast.

Re: [APKG] BitTorrent Sync

Post by Kapitein Haak »

liefde wrote:http://www.cyberciti.biz/faq/how-can-i-log-in-as-root/

"remote root login over ssh session is disabled in most cases for security reasons. First, login as a normal user and then switch to root account using the su command"

http://security.stackexchange.com/quest ... a-password

"First of all, you must understand that user authentication is a different and separate process than the establishment of the secure channel. In laymans terms what this means is that first, the public key of the server is used (if accepted!) to construct the secure SSH channel, by enabling the negotiation of a symmetric key which will be used to protect the remaining session, enable channel confidentiality, integrity protection and server authentication."
From the exact same source on the internet:
liefde's source wrote:After the channel is functional and secure, authentication of the user takes place
Do note the word "secure".
If you are really paranoid about people hacking you or accessing your data, you would not be even using a computer at all... You would use paper and pen to create your data, a cigarette lighter, mortar and a pestle to remove the data. Even a standalone PC without any network access can be monitored: http://en.wikipedia.org/wiki/Van_Eck_phreaking
"What would the world be like without Captain Hook?"
---
"Homo sapiens non urinat in ventum" (A wise man doesn't piss into the wind), only in Amsterdam:
https://www.google.nl/maps/@52.36289,4. ... 312!8i6656
liefde
Posts: 56
Joined: Sat Feb 08, 2014 12:05 am

Re: [APKG] BitTorrent Sync

Post by liefde »

Ever hear of a thing called brute force ? Really, you should go back to school: http://www.cisco.com/web/about/security ... urity.html

"Key Lessons Learned

PermitRootLogin? Why?

Figure 1 showed just over a third of the login attempts trying to access the system via the user ID root. There is very little reason for enabling root to log in directly to the system via SSH. Disabling root logins is easily accomplished using the configuration file for the SSH daemon. On systems that are running the OpenSSH version of the SSH server, simply setting the configuration directive PermitRootLogin to no is all that is required. Usually PermitRootLogin is set to no by default. After changing the SSH configuration to disable root logins, administrators must restart the daemon to force it to reread the configuration file.

Is there a downside to this configuration? The only disadvantage is a slight amount of inconvenience. Instead of being able to log in directly and have administrative privileges immediately available, users may need to run a utility such as sudo or su after authenticating to enable the higher privilege level. From a security standpoint, this configuration is typically preferable because it requires double authentication before such privileges are granted and does not easily facilitate attempts to guess the password of the root user. It also provides more detailed log messages—beyond simply an IP address—to identify those users who have attempted to increase their privilege level."

And your final argument is entirely misplaced. The problem here is: There is NO SSH config to speak of. One is unable to use secure private-public key exchange to login. There is not a security difference between admin and root. Last but not least, we're at OpenSSH 6.5 now, the version on the nas is oooooold and prone to zerodays..
User avatar
clinton.hall
Posts: 845
Joined: Thu May 09, 2013 7:01 pm
Location: New Zealand
Contact:

Re: [APKG] BitTorrent Sync

Post by clinton.hall »

Ok. If you don't want to use my App, then delete it.

This sub-forum is not a place to moan about the OS. If you want to moan about the OS, then I suggest you do it in the sub-forum that is dedicated to ADM.

And again, if you really knew what you were doing you would have CHANGED your root password to be different to your admin password.

Now, I have tried to be polite here, because it is pretty sad to try and put people down online. But seriously, telling someone to go back to school?

First of all: you have not established that the subject is not still in school, or in fact that the subject was every able to attend school.
Second: you have not demonstrated any significant education or understanding beyond showing that you are capable to putting keywords into google and post the link on a forum.
Third: I can show a list of degrees, qualifications, awards, achievements, transcripts etc that show I not only went to school, but am generally quite intelligent (intelligent enough not to assume I am smarter than everyone else on the forum).
Fourth: Given how concerned with (and clearly informed about) security you are, why did you buy a commercial/home use device? You could have bought some HDDs, a motherboard, a case, CPU, etc, and build your OWN NAS.... once again i am going to state that most (if not all) comerically available NAS behave this same way. So you are the one who seems to have not done research before investing in a product.
Last but not least, we're at OpenSSH 6.5 now, the version on the nas is oooooold and prone to zerodays..
Well... I thought you wanted people to stop developing better software and just use something that they know works? So which is it? - note- rhetorical question. please don't respond here unless it is about BitTorrentSync App. I am a moderator on this sub-forum and I will just delete posts if we keep getting dragged down this very off-topic path.... I am now far too bored with this conversation. I spend a lot of time HELPING people on these forums... if you have a legitimate issue I am likely to ignore you and offer no assistance because you have wasted too much of my time already.
AS-604T
3 x ST4000DM0000 (Seagate 4TB) in Raid5
2 GB RAM expansion
AS-302T

Apps (user)
NZBGet - CouchPotato - SickBeard - Git - Python

Apps (maintainer):
NZBGet - BitTorrent Sync - Mylar - LazyLibrarian - Gamez
-Maintenance of Apps acquired from JohhnyFive since ADM2.0:
SABnzbd - CouchPotato - SickBeard - HeadPhones - Subsonic

About Me: http://fockwulf.wix.com/index
liefde
Posts: 56
Joined: Sat Feb 08, 2014 12:05 am

Re: [APKG] BitTorrent Sync

Post by liefde »

http://forum.bittorrent.com/topic/24934 ... nux-webui/

If you can proxy it, just like utorrent, via nginx over ssl, that would be great.
It's really weird that this is done all in the open and public now.

http://askubuntu.com/posts/352240/revisions

for now, I'll have to keep it local or without webgui access.
User avatar
clinton.hall
Posts: 845
Joined: Thu May 09, 2013 7:01 pm
Location: New Zealand
Contact:

Re: [APKG] BitTorrent Sync

Post by clinton.hall »

https://www.dropbox.com/s/63vlgpofx4n2d ... 24_any.apk

this update will use nginx to give https access to btsync on port 5566.

I don't believe there is an option in btsync to restrict http access to localhost only (as with utorrent) so make sure port 5555 is not open.

If there is an easy way to add this restriction etc, Please let me know. I am not that savvy with nginx settings.
AS-604T
3 x ST4000DM0000 (Seagate 4TB) in Raid5
2 GB RAM expansion
AS-302T

Apps (user)
NZBGet - CouchPotato - SickBeard - Git - Python

Apps (maintainer):
NZBGet - BitTorrent Sync - Mylar - LazyLibrarian - Gamez
-Maintenance of Apps acquired from JohhnyFive since ADM2.0:
SABnzbd - CouchPotato - SickBeard - HeadPhones - Subsonic

About Me: http://fockwulf.wix.com/index
Post Reply

Return to “BitTorrent Sync”