Encrypting Zoneminder traffic with ssh tunnel
Posted: Thu Dec 10, 2009 12:10 pm
I wish to access the server remotely to check that all is safe when
I'm away. But, even though I can turn on authentication to limit
access, I wouldn't be happy to have the security cameras send me the
images in clear, as they would be seen by all the machines along the
way. So I want to encrypt that traffic.
After some experimentation I've got this almost working, and I hope it
will also be useful to others.
What I do is ssh into the server and tunnel the http connection
through that, as follows:
client% ssh -L 8080:localhost:80 server.isp.com
This, as you might know, opens port 8080 on localhost and forwards any
requests to port 80 on server.isp.com over the ssh tunnel. Then I
point the client's browser at http://localhost:8080 and I should be
receiving the zoneminder console over the encrypted link.
So far so good. I get the console, OK. And I can view the individual
monitors, including the moving picture in the little window.
HOWEVER the montage window is instead totally blank and the cycle
window is filled up with error messages, reproduced at the end of this
post.
I confirm that both cycle and montage work fine, with the same browser
(firefox), if I instead access the server directly without the port
forwarding.
I also tried forwarding to local port 80 instead of 8080 (which
requires a little more acrobatics as it's a privileged port), just in
the unlikely case that something had a hardcoded :80 somewhere, but it
still didn't work.
Does anyone know if these two windows, cycle and montage (or the
javascript they make use of) require other ports that I should be
forwarding as well?
By the way, I don't think this is a very version-specific issue but in any case this is on a clean install, from source, of Zoneminder 1.24.2 on
Ubuntu server 9.10, and I'm viewing that from Firefox 3.5.5 on an Ubuntu 9.10 desktop.
Thanks in advance
APPENDIX: error messages in the cycle window when viewed through localhost:8080
Notice: Undefined offset: 0 in /var/www/skins/classic/views/cycle.php on line 63
Notice: Undefined offset: 1 in /var/www/skins/classic/views/cycle.php on line 64
Warning: Division by zero in /var/www/skins/classic/views/cycle.php on line 67
Warning: Division by zero in /var/www/skins/classic/views/cycle.php on line 68
Warning: Cannot modify header information - headers already sent by (output started at /var/www/skins/classic/views/cycle.php:63) in /var/www/includes/functions.php on line 97
Warning: Cannot modify header information - headers already sent by (output started at /var/www/skins/classic/views/cycle.php:63) in /var/www/includes/functions.php on line 98
Warning: Cannot modify header information - headers already sent by (output started at /var/www/skins/classic/views/cycle.php:63) in /var/www/includes/functions.php on line 99
Warning: Cannot modify header information - headers already sent by (output started at /var/www/skins/classic/views/cycle.php:63) in /var/www/includes/functions.php on line 100
Warning: Cannot modify header information - headers already sent by (output started at /var/www/skins/classic/views/cycle.php:63) in /var/www/includes/functions.php on line 101
I'm away. But, even though I can turn on authentication to limit
access, I wouldn't be happy to have the security cameras send me the
images in clear, as they would be seen by all the machines along the
way. So I want to encrypt that traffic.
After some experimentation I've got this almost working, and I hope it
will also be useful to others.
What I do is ssh into the server and tunnel the http connection
through that, as follows:
client% ssh -L 8080:localhost:80 server.isp.com
This, as you might know, opens port 8080 on localhost and forwards any
requests to port 80 on server.isp.com over the ssh tunnel. Then I
point the client's browser at http://localhost:8080 and I should be
receiving the zoneminder console over the encrypted link.
So far so good. I get the console, OK. And I can view the individual
monitors, including the moving picture in the little window.
HOWEVER the montage window is instead totally blank and the cycle
window is filled up with error messages, reproduced at the end of this
post.
I confirm that both cycle and montage work fine, with the same browser
(firefox), if I instead access the server directly without the port
forwarding.
I also tried forwarding to local port 80 instead of 8080 (which
requires a little more acrobatics as it's a privileged port), just in
the unlikely case that something had a hardcoded :80 somewhere, but it
still didn't work.
Does anyone know if these two windows, cycle and montage (or the
javascript they make use of) require other ports that I should be
forwarding as well?
By the way, I don't think this is a very version-specific issue but in any case this is on a clean install, from source, of Zoneminder 1.24.2 on
Ubuntu server 9.10, and I'm viewing that from Firefox 3.5.5 on an Ubuntu 9.10 desktop.
Thanks in advance
APPENDIX: error messages in the cycle window when viewed through localhost:8080
Notice: Undefined offset: 0 in /var/www/skins/classic/views/cycle.php on line 63
Notice: Undefined offset: 1 in /var/www/skins/classic/views/cycle.php on line 64
Warning: Division by zero in /var/www/skins/classic/views/cycle.php on line 67
Warning: Division by zero in /var/www/skins/classic/views/cycle.php on line 68
Warning: Cannot modify header information - headers already sent by (output started at /var/www/skins/classic/views/cycle.php:63) in /var/www/includes/functions.php on line 97
Warning: Cannot modify header information - headers already sent by (output started at /var/www/skins/classic/views/cycle.php:63) in /var/www/includes/functions.php on line 98
Warning: Cannot modify header information - headers already sent by (output started at /var/www/skins/classic/views/cycle.php:63) in /var/www/includes/functions.php on line 99
Warning: Cannot modify header information - headers already sent by (output started at /var/www/skins/classic/views/cycle.php:63) in /var/www/includes/functions.php on line 100
Warning: Cannot modify header information - headers already sent by (output started at /var/www/skins/classic/views/cycle.php:63) in /var/www/includes/functions.php on line 101