3

I've successfully configured a Motion webcam server for monitoring my puppy as he destroys the kitchen: The video is presented within an HTML page with allows for basic HTTP authentication, but is presented only with an unsecure HTTP (http://192.168.1.20:8081) connection.

As I would ultimately like to present this stream externally (I'm familiar with port forwarding), I was wondering how I would go about presenting this with HTTPS to prevent eavesdropping and ensure the password information sent is invisible.

I know it would be possible to somehow proxy this on the Pi, but I do not know the terminology to search for or where to begin looking!

The desired end state would be to connect to https://myFreeDomain.net/, provide credentials and then view the webpage presented internally as http://192.168.1.20:8081.

The Motion service can present the webpage as http:// localhost if needed.

Thanks in advance for any advice or examples you can provide, or any additional help,

James

  • "I know it would be possible to somehow proxy this on the Pi, but I do not know the terminology to search for or where to begin looking!" -> In fact you do. You want arrange a (forward) proxy: en.wikipedia.org/wiki/Proxy_server Take "server" to refer to a piece of software and not "discrete machine". – goldilocks Feb 9 '17 at 12:43
  • Thanks, @goldilocks - Thanks for the pointer to "forward proxying", I'll see how I get on now I know I'm looking in the right place! – James Finch Feb 9 '17 at 14:29
  • 1
    As C Malasadas pointed out, you'll need an SSL certificate. They don't have to cost money. Letsencrypt is a free, trusted SSL provider that I use on my own projects. – Jacobm001 Feb 9 '17 at 16:20
  • 1
    Also, you can create your own CA (certificate authority), use that to sign the server certificate, and install the CA cert into a web browser and it will trust your server. Doesn't cost anything, doesn't require any one else, and is only 5 minutes more complicated than creating a self-signed cert. – goldilocks Feb 9 '17 at 16:48
  • Thanks @goldilocks - I'll have a look at creating my own CA in the future, but will wimp out now as my geek stamina is waning. Solution posted. – James Finch Feb 10 '17 at 13:41
3

Right, I got there in the end!

Using Apache 2.2.22

SSL Proxy Configuration

Install Apache2

sudo apt-get install apache2

Enable Apache2 Modules for Proxying & SSL

sudo a2enmod proxy
sudo a2enmod proxy_http
sudo a2enmod ssl

Create directory and SSL Cert

sudo mkdir /etc/apache2/ssl/

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/puppycam.key -out /etc/apache2/ssl/puppycam.crt

Configured as follows:

Country Name (2 letter code) [AU]:UK
State or Province Name (full name) [Some-State]:Berkshire
Locality Name (eg, city) []:Tilehurst
Organization Name (eg, company) [Internet Widgits Pty Ltd]:mysite
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:puppycam.mysite.com
Email Address []:administrator@mysite.com

Create VirtualHost File for service:

sudo vim /etc/apache2/sites-available/001-SecureWebcam.conf

Contents:

<VirtualHost *:443>


ProxyRequests Off
SSLProxyEngine On

<Proxy *>
  Order deny,allow
  Allow from all
</Proxy>


ProxyPass / http://192.168.1.20:8081/
#ProxyPassReverse / http://192.168.1.20:8081/

<Location /proxy/>
  ProxyPassReverse /
  Order deny,allow
  Allow from all
</Location>
        ServerAdmin webmaster@localhost
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

                SSLEngine on

                SSLCertificateFile      /etc/apache2/ssl/puppycam.crt
                SSLCertificateKeyFile /etc/apache2/ssl/puppycam.key





                <FilesMatch "\.(cgi|shtml|phtml|php)$">
                                SSLOptions +StdEnvVars
                </FilesMatch>
                <Directory /usr/lib/cgi-bin>
                                SSLOptions +StdEnvVars
                </Directory>

                BrowserMatch "MSIE [2-6]" \
                                nokeepalive ssl-unclean-shutdown \
                                downgrade-1.0 force-response-1.0
                BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown



</VirtualHost>

Enable Site

sudo ln -s /etc/apache2/sites-available/001-SecureWebcam.conf /etc/apache2/sites-enabled/001-SecureWebcam.conf 

Restart Apache

sudo service apache2 restart

Test access to webcam from https://192.168.1.22 (internal address of Apache server)

Install & Configure Dynamic DNS (for Google Domains)

Accept all defaults - we wil change later

sudo apt-get install ddclient

Edit the ddclient config

sudo vim /etc/ddclient.conf

Contents:

ssl=yes
protocol=googledomains
use=web
server=domains.google.com
login=thisisasecret
password='thisisalsoasecret'
puppycam.mysite.com

Security Configuration

Create a directory for the password file

sudo mkdir /etc/htpasswd/

Add a user to the password file

sudo htpasswd -c /etc/htpasswd/.htpasswd james

Edit the VirtualHost configuration to add authentication:

sudo vim /etc/apache2/sites-available/001-SecureWebcam.conf

Modify the <Proxy *> section as follows:

...
<Proxy *>
  AuthType Basic
  AuthName "Authentication Required"
  AuthUserFile "/etc/htpasswd/.htpasswd"
  Require valid-user
  Order deny,allow
  Allow from all
</Proxy>
...

Enable the appropriate authentication modules:

sudo a2enmod authn_file
sudo a2enmod auth_basic

Restart Apache2

sudo service apache2 restart

Mop Up Actions

  1. Perform network capture to be sure allk traffic is secure (no plain text password)
  2. Configure Port Forwarding on router
  3. Test remote access
-3

In order to get an https:// website, you need an SSL certificate. (Costs $).

You can encrypt your traffic without https.

Https is just a certification for websites to prove that they are encrypted (like your bank, who wants to show customers that it is secure)

No need for https, you can just encrypt it.

  • Thank you for your input @c-malasadas. You're right - I'd need a cert issued from a trusted Certificate Authority to prevent browser warnings for users, but for this non-production service as I can always issue my own (untrusted) one for free and import it on the clients. – James Finch Feb 9 '17 at 15:50
  • But what's the point? If you're faking the certificate, it doesn't make it encrypted or any more secure. – C Malasadas Feb 9 '17 at 15:52
  • 1
    Your answer doesn't really answer the question. You've merely presented an obstacle; one that isn't even correct. [Letsencrypt](letsencrypt.org) is a free SSL provider that is trusted by every major browser. – Jacobm001 Feb 9 '17 at 16:29
  • 1
    "Https is just a certification for websites" -> No. HTTPS is HTTP + TLS. TLS can be use to validate that a server is who it claims to be if it uses a certificate backed by an authority recognised by the client, but its primary purpose is encyption, which does not require validation of either party's identity. Note that the authority used for validation does not have to be from a public CA (including letscrypt, etc.), it could be one created privately -- just the client must have been preconfigured to trust it (which is all a bit besides the point, but FYI). – goldilocks Feb 9 '17 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.