Test your ruTorrent installation

[somus1735]

This is a script that will test your ruTorrent installation from a remote computer. The most important thing it tests is that your RPC mounts are secure. If they're not, then your computer could be hacked. It currently tests this:

- RPC mount points are protected (requires password)
- user1 can't access user2's RPC mount point
- user1 can access his own RPC mount point
- No files in rutorrent/conf or rutorrent/share can be accessed
- Only an authenticated user can access ruTorrent
- .svn dirs can't be accessed
- user1 can't execute code (NOTE: only a few tests!)

These are only remote tests. Any user with shell access could do more stuff.

If you can think of other tests, let me know and I'll add them.

Code:
wget -O httpd-test.sh http://autodl-irssi.svn.sourceforge.net/viewvc/autodl-irssi/trunk/httpd-test.sh?content-type=text/plain
sh httpd-test.sh 192.168.0.123 /rutorrent user1 pass1 /RPC1 user2 pass2 /RPC2
sh httpd-test.sh 192.168.0.123 /rutorrent user1 pass1 /RPC1

The IP address is the server. /rutorrent is the URL path to ruTorrent. The rest are self-explanatory.
If you need HTTPS access, edit the file and change protocol=http to https and port=80 to 443.

You will need curl and xmlrpc installed. xmlrpc is compiled (but not automatically installed) when you compile XMLRPC-C. Debian/Ubuntu users: apt-get install libxmlrpc-c3-dev

 

[shwetha17]

I'm getting a 404 error when trying to download this script.

 

[randac56]

Thanks for this cool script! I'm trying to lock down my rutorrent installation and I'm still failing two tests:
FAILED: XMLRPC: Could execute code (execute_capture)
FAILED: XMLRPC: Could execute code (execute_capture_nothrow)

Any idea on how I can lock those down. It's now a quest to pass your script 100%.

 

[randac56]

Nevermind. I found this patch that you wrote: http://forums.rutorrent.org/index.php?topic=638.msg4709#msg4709
Found it here http://mirror.transact.net.au/sourceforge/a/project/au/autodl-irssi/

I ran the patch and passed 100%. Any reason why you aren't hosting the patch anymore? Did you find out it didn't work right or something?

 

[jith45]

Jumped of joy when I found this script, but unfortunately I'm unable to get it to run.
Could some kind soul help me?

I wgetted this:
http://autodl-irssi.svn.sourceforge.net/viewvc/autodl-irssi/trunk/httpd-test.sh?revision=461&view=markup&pathrev=660

chmoded it and ran it as such:

Code:
./httpd-test.sh my.secretdomain.tld / myuser mypass /RPC2(I have rutorrent straight on webroot)

This is the output I get:

Server: my.secretdomain.tld
Web server: Cherokee/1.2.2 (Debian GNU/Linux)
Could not detect rtorrent version. Is it running?

What am I doing wrong?

 

[randac56]

I ran mine as:
Code:
./httpd-test.sh ipaddress /rutorrent user pass RPC2
Try taking off the leading slash on /RPC2.

 

[peshua19]

I ran mine as:
Code:
./httpd-test.sh ipaddress /rutorrent user pass RPC2
Try taking off the leading slash on /RPC2.

Tried it and it doesnt make any difference. Could it be that I'm using an old version of the script?

I wgetted this file: http://autodl-irssi.svn.sourceforge.net/viewvc/autodl-irssi/trunk/httpd-test.sh?revision=461&view=markup&pathrev=660

Maybe its outdated? or needs to get patched? which file are you guys using?

 

[lisas4567]

Jumped of joy when I found this script, but unfortunately I'm unable to get it to run.
Could some kind soul help me?

I wgetted this:
http://autodl-irssi.svn.sourceforge.net/viewvc/autodl-irssi/trunk/httpd-test.sh?revision=461&view=markup&pathrev=660

chmoded it and ran it as such:

Code:
./httpd-test.sh my.secretdomain.tld / myuser mypass /RPC2(I have rutorrent straight on webroot)

This is the output I get:

Server: my.secretdomain.tld
Web server: Cherokee/1.2.2 (Debian GNU/Linux)
Could not detect rtorrent version. Is it running?

What am I doing wrong?

I am also running Debian, but on lighttpd, but I am getting the same error. After installing curl and xmlrpc, the script fails to run with:

Server: host.domain.tld
Web server: lighttpd/1.4.30
Could not detect rtorrent version. Is it running?

I can connect to rutorrent via HTTPS at /rutorrent in my web browser, and mount is RPC2. I run this when I call the script:

./httpd-test.sh host.domain.tld /rutorrent user password /RPC2

and I also tried without the slash in front of RPC2 with the same error.


Any hints on troubleshooting this so I can make sure my rutorrent installation is secure?