Remote viewing of cameras via RemotePatrol with Apache Proxy / reverse ssh tunnel

jstn

I've got SecuritySpy running on a Mac-mini server and I also run a Linode VPS server (not currently related to my camera setup).

My goal is to use RemotePatrol on my iPhone to access/authenticate to my cameras through my Linode server (via an Apache Proxy/reverse ssh tunnel back to my Mac-mini).

Has anyone done this before? Configuring the tunnels and the http proxy isn't a huge challenge but I'm a little miffed by the internal web server SecuritySpy uses.

Any tips/help is appreciated!

Justin

Ben

Hi Justin,

A reverse proxy using Apache is relatively simple and there's no reason why this wouldn't work. But the SSH tunnel - while it seems to be possible, I don't have any experience of this. What are you trying to achieve with the overall setup that you can't do by accessing SecuritySpy's web server directly?

jstn

Hey Ben,

I don't want to have to NAT ports on my home network back to the web server.

I'll give this a go over the next week or so and let you know how it goes...

Best,

Justin

Ben

Hi Justin,

If you use secure passwords and SecuritySpy's encrypted HTTPS web interface, you should have nothing to worry about with opening up access to SecuritySpy from the internet. After all, if you consider this a problem, by implementing the solution outlined above aren't you simply pushing the same problem back to your Linode VPS, rather than eliminating it? In fact I would say that Apache is more exploitable for a hacker than SecuritySpy's web server (e.g. due to the fact that Apache does server-side scripting).

jstn

For those interested, I was able to get my reverse proxy with ssh configured and working (when accessed with a web browser, RemotePatrol doesn't work due to a bug).

Machine "A" is my SecuritySpy server at home. Machine "B" is my Linode VPS. This is not a step-by-step tutorial.

1. Create a reverse SSH tunnel from "A" to "B":

On Machine A:

ssh -N -R 8888:localhost:8000 username@ServerB

2. On "B", enable mod_proxy and add the following to your server config:

ProxyPass /cams/ http://localhost:8888/

When you restart Apache, access the following URL: mydomain.com/cams/ and what will show up is the login window for your SecuritySpy web server. Enter the username/password and you will be presented with the main screen for the web server.

If you have any questions, feel free to ask. I realize there isn't a lot of detail above, but the process is rather simple.

Best,

Justin

jstn

I submitted the following bug info to RemotePatrol customer support... posting it here for anyone else's need. Essentially, one should be able to follow my instructions above, to create a reverse proxy, then access the public web server with RemotePatrol and "Add" a server, just like you were on your local network. The problem is a bug in RemotePatrol when it constructs a URL to initialize contact with the SecuritySpy web server.

This is another way to get remote viewing without having to punch holes in your router or use a Dynamic DNS service.

I run SecuritySpy from a Mac Mini on my home network. I also run a Linode VPS server. When I'm outside my home network, I access my Linode server which uses a reverse proxy to connect back to my home network to view my SecuritySpy server.

The problem is that RemotePatrol adds bogus text when you do not specify a network port in the "Add New Server" screen. Here are the details:

The request I see on my server, when I do not specify a "Network Port" is:

108.20.135.80 - - [28/Dec/2014:16:00:59 -0500] "GET /cams/:0/++systemInfo&auth=xxxxxxx HTTP/1.1" 404 18 "-" "RemotePatrol/1427 CFNetwork/711.1.16 Darwin/14.0.0"

The "Network Address" I used was MyDomain.com/cams/. I did not specify ANY port in the configuration, but RemotePatrol incorrectly appends ":0" to the requesting URL. If I remove the offending text from the link above, I receive the XML file that RemotePatrol is trying to request.

When I do enter a specific "Network Port" (in this case 8000), I get the following, which is expected:

108.20.135.80 - - [28/Dec/2014:16:07:25 -0500] "GET /cams/:8000/++systemInfo&auth=xxxxxxx HTTP/1.1" 404 255 "-" "RemotePatrol/1427 CFNetwork/711.1.16 Darwin/14.0.0"

Hoping this can get fixed soon. I'm going to try and create an Apache mod_rewrite rule to fix the problem URL as a work around.

Justin

Ben

Hi Justin,

Great to hear you've got this working! Thanks for posting the solution.

I can see why Remote Patrol doesn't work with the URL, as it is expecting direct access to SecuritySpy which isn't in a directory such as /cams/ - hopefully the developers of Remote Patrol can make some changes to make it work in this situation.

Note that Remote Patrol isn't adding bogus text to the request: the "auth" parameter is a Base64 encoding of your username and password. RP adds this to all requests in order to improve performance and get round a few problems that were encountered with authentication for movie playback. However appending ":0" when you don't specify a port is odd behaviour - you could suggest to the developers that RP should avoid appending any kind of port information when no port number is specified - this should make everything work as expected.

jstn

Hi Ben,

Sorry, when I said "bogus text" I was only referring to the ":0" characters. I understand what the encoded text is used for. If Remote Patrol doesn't prepend ":0" to the URL, then access to Security Spy works perfectly (which is why I reported it as a bug in RP). The "/cams/" directory only appears in the reverse proxy URL and is not passed back to the Security Spy server.

The primary reason for me using a reverse proxy is so that I don't have to open any ports on my router. I've been talking with Rob about this issue. He told me he wasn't able to reproduce it, which is odd. Hopefully he looks into it more and can reproduce it.

In the meantime I'm accessing my server via Chrome on my iPhone.

Any plans to create a mobile-optimized version of the SecuritySpy web front-end?

Best,

Justin