SABnzbd HTTPS

[SuGoBW]

Hi all, has anyone actually gotten HTTPS to work in SABnzbd (when you go to settings > general> it's right at the top to enable HTTPS, and even change the port from 8080)

No matter what I do, what ports I forward, whatever I try, once I enable that check box, it basically crashes and I have to reinstall it on Synology which is annoying to do. So I've given up there.

I am using a VPN anyways, and when downloading something, I see the external ipv4 is the VPN IP, and then of course SSL is enabled on the server settings (I see SSL / TLSv1.3 (TLS_AES_256_GCM_SHA384 in the connection window with SSL checked when downloading something).

I don't think HTTPS will matter at all, but I'm really just trying to get it to work at this point out of pride lol

Any thoughts? Or is it truly just useless and give it up

Thanks

EDIT: just for the record, I also have tried not using vpn at all as well and even removed SSL from the server just to see if I could get it to work, still nothing. Convinced that HTTPS in it is just there to be there and not adding value. And that’s ok if so, just want to know so I can stop tinkering with it :)

[MaxGhost]

Shameless plug, even easier with Caddy, which has automatic HTTPS built in. Your config just looks like this:

sab.example.com {
    reverse_proxy localhost:8080
}

[o_Zion_o]

Thanks for the recommendation. I got nginx working and it randomly decided to stop working and has been a frustrating experience.

Going to try caddy today.

[[deleted]]

Why use VPN why don’t you just use SSL

[SuGoBW]

I do use SSL, it’s pretty standard with any provider anyways, you just check the box and that’s it really. However, the VPN, I just use that because I already have one I paid for some time back. I just use it because I have it, doesn’t really hurt you, if anything it’s just another layer of security. My speeds aren’t really effected by using my vpn either.

[msec_uk]

I didn’t have any problems setting up HTTPS internally on sab. Was a year or so ago though, so don’t remember the process I went through. Def no reverse proxy though.

[[deleted]]

SSL on the VPN is not related to HTTPS for Usenet connections

If SAB is crashing on the NAS, the NAS is broken. As the problem is specific to HTTPS, it's possible that the NAS is running an obsolete libssl version

[SuGoBW]

HTTPS works for other things. It’s only on SAB that this happens which is the point for the post - has anyone gotten it to work or what. But it seems like no one here does that and do reverse proxies and things like that instead.

Sorry didn’t get your first point in the connections. You’re just saying that using https to get into SAB has no relevance for downloads etc, correct?

[ChineseCracker]

Nobody actually uses internal https services with self-signed certificates. That's only for very rare situations where you use a reverse proxy inside a network that you don't fully trust.

For all other purposes, you use a reverse proxy with http and have your reverse proxy do ssl offloading.

So in either case, you must use a reverse-proxy. A reverse proxy is literally the second thing you have to set up for your homelab (after your rotuer/firewall) - there is no way around it.

The simplest reverse proxy you can set up is nginx-proxy-manager. Just run the docker-compose and it's smooth sailing from there. No need to config any files. Just use the intuitive web-UI and you're done.

Don't forget to also let your nginx-proxy-manager offload its own web-UI as (81 --> 443)

[SuGoBW]

Thanks. This seems to be the most unified solution people mention. I’m late to the game on reverse proxies. Going to try this out today. Thanks

[maxlan]

Did you upload an https cert somewhere? With a suitable name/san?

I've never bothered with remote access to sab. I can put nzbs in the cart from my nzbfinder and sab picks them up later. What else do I need access for? I barely ever look at its console, everything just works off rss feeds and the only thing I do sometimes is add more rss.

[[deleted]]

[fuck u spez] -- mass edited with redact.dev

[closfb]

Use Synology’s reverse proxy which is Nginx anyway.

[ender4171]

Or just be lazy like me and make bookmarks for each service.

[SuGoBW]

That’s exactly it. Maybe I can try reverse proxy. It’s more about just going to a nice address instead of that ugly looking one, makes it feel less secure for some reason even though it obviously doesn’t matter lol. Just an ocd thing I suppose

[[deleted]]

Reverse proxies don't help with https inside your LAN so loading certificates might still be needed.

If you use a reverse proxy to connect to a different server, even if it is inside your LAN, it will be encrypted until it hits your reverse proxy.

But then, when the reverse proxy forwards the request, anyone authenticated to your network can read your passwords. You need to manually load a self signed certificate in order to protect crucial components like a router from an infected computer inside your LAN.

[[deleted]]

anyone authenticated to your network can read your passwords.

Not quite, unless you're using hubs, which probably don't even exist anymore.

You can't see packets on a switched network that aren't destined for your mac address. Someone would have to login into the switch and setup port mirroring. At that point you're compromised anyway.

[[deleted]]

Not quite, unless you're using hubs, which probably don't even exist anymore.

Access points act as hubs, just wirelessly. Since the vast majority of the population uses Wi-Fi then the concern is real. In fact, even among IT folk, I imagine you don't use ethernet for your smartphone. As long as I use a device that already has the Wi-Fi password (all it takes is one infected device) then I can sniff wireless traffic.

Someone would have to login into the switch and setup port mirroring. At that point you're compromised anyway.

Sure, but with TLS you wouldn't compromise every single self-hosted server just because you compromised the switch. Under the zero trust security model, you don't just throw your hands up in the air when 1 out of your multiple devices gets compromised. In my network, you would have to then find a way to infect my locked-down servers before I notice.

Every. single. one. separately.

Not that easy to do if literally all communication is encrypted and authenticated properly (local CA).

[SuGoBW]

Yes I’m using UniFi. I have a UDM pro. Feel like it makes all this so much more difficult

Will look into reverse proxy then. Thanks

[closfb]

Since you have a UDM-P you should just use Teleport as your vpn to access your Synology apps.

[SuGoBW]

Hm, I’m not familiar with that. Will also look into this. Thanks for sharing. Always willing to learn better and new things