[HowTo] Bookworm: Set up a headless torrentserver with Web/App control

[Hallvor]

1. General info

Following this guide, you will get a headless server running the BitTorrent file sharing protocol.

This HowTo is written for those who would like to set up their first Debian torrentserver. It is written for Debian 12 (bookworm), but the following instructions may also work with later versions.

Commands are typed in code brackets and can usually be copied and pasted into the command line interface of your server.

$ in front of the code means that the command should be executed as regular user.
# in front of the code means that the command should be executed as root.

You can change from regular user to root by typing su - on a system that has root enabled. In order to change to regular user from root, you can type su - yourusername, type exit at the command prompt or press Ctrl-D.


2. What is BitTorrent?

BitTorrent is a peer-to-peer file sharing protocol used for downloading and distributing files.

Transmission is a BitTorrent client which features a variety of user interfaces on top of a cross-platform back-end. This offers flexibility and seamless integration on various desktop environments and devices.


3. Why run a headless server?

There are several reasons why you would want to run a client like Transmission on a headless server:
* File availability: Servers are made to always stay on, making sure that your files can be downloaded at any time.
* Low system requirements: A headless server will only use a fraction of the system requirements of a laptop with a GUI. Even sharing hundreds of torrents isn't a problem on modest hardware like an old Raspberry Pi.
* Reduced attack surface: Whenever you share a file with BitTorrent, you also expose your IP address. A headless client is simply running fewer things to attack.
* Stability: There are generally fewer things that can go wrong on a headless server, because less code is run and less code is altered. You can set it up once and run it for years.


4. Why Transmission on the server?

Transmission is usuallly regarded as one of the best BitTorrent clients because:
* It is lightweight
* It is flexible
* It is open source
* It has a Web interface
* It can be administered with an Android app
* It is under active development

However, it is not the only one that can be run from a command line interface. There is also rTorrent, Deluge Console, qbittorrent-nox, ctorrent and probably several others.


5. Set up a headless server

This requires quite a few steps, but fortunately I have written about them before. I will assume below that you'll create a root password for your server. Follow sections 1-8 and optionally 10 (security) here: viewtopic.php?t=153625 I highly recommend disabling SSH requests from outside your LAN (as shown under section 10 in the mentioned guide), and that you pick a strong root-password. Once you are connected to your server with SSH, proceed to the step "Create a Transmission user" if you didn't already make a user called that during install.


6. Create a Transmission user

Code: Select all

$ su -

Enter your root password.

Then paste in the following command:

Code: Select all

# adduser transmission

This command will create a user with the name transmission

You will get prompted the transmission user's password. Please do not use the same password as the root user for security reasons.


7. Install transmission

Code: Select all

# apt install transmission-cli transmission-common transmission-daemon 

Stop transmission-daemon

Code: Select all

# systemctl stop transmission-daemon.service

8. Configure transmission

We'll make a few changes before everything is ready.


8.1 Edit the configuration file:

Code: Select all

# nano /var/lib/transmission-daemon/info/settings.json

Paste this content into the configuration file, or edit your current one accordingly.

Code: Select all

"alt-speed-down": 50,
    "alt-speed-enabled": false,
    "alt-speed-time-begin": 540,
    "alt-speed-time-day": 127,
    "alt-speed-time-enabled": false,
    "alt-speed-time-end": 1020,
    "alt-speed-up": 50,
    "bind-address-ipv4": "0.0.0.0",
    "bind-address-ipv6": "::",
    "blocklist-enabled": false,
    "blocklist-url": "http://www.example.com/blocklist",
    "cache-size-mb": 4,
    "dht-enabled": true,
    "download-dir": "/home/transmission/downloads",
    "download-limit": 100,
    "download-limit-enabled": 0,
    "download-queue-enabled": true,
    "download-queue-size": 5,
    "encryption": 1,
    "idle-seeding-limit": 30,
    "idle-seeding-limit-enabled": false,
    "incomplete-dir": "/home/transmission/transmission-temp",
    "incomplete-dir-enabled": false,
    "lpd-enabled": false,
    "max-peers-global": 200,
    "message-level": 1,
    "peer-congestion-algorithm": "",
    "peer-id-ttl-hours": 6,
    "peer-limit-global": 200,
    "peer-limit-per-torrent": 50,
    "peer-port": 51413,
    "peer-port-random-high": 65535,
    "peer-port-random-low": 49152,
    "peer-port-random-on-start": false,
    "peer-socket-tos": "default",
    "pex-enabled": true,
    "port-forwarding-enabled": false,
    "preallocation": 1,
    "prefetch-enabled": true,
    "queue-stalled-enabled": true,
    "queue-stalled-minutes": 30,
    "ratio-limit": 2,
    "ratio-limit-enabled": false,
    "rename-partial-files": true,
    "rpc-authentication-required": true,
    "rpc-bind-address": "0.0.0.0",
    "rpc-enabled": true,
    "rpc-host-whitelist": "",
    "rpc-host-whitelist-enabled": true,
    "rpc-password": "transmission",
    "rpc-port": 9091,
    "rpc-url": "/transmission/",
    "rpc-username": "transmission",
    "rpc-whitelist": "127.0.0.1,192.168.*.*",
    "rpc-whitelist-enabled": true,
    "scrape-paused-torrents-enabled": true,
    "script-torrent-done-enabled": false,
    "script-torrent-done-filename": "",
    "seed-queue-enabled": false,
    "seed-queue-size": 10,
    "speed-limit-down": 100,
    "speed-limit-down-enabled": false,
    "speed-limit-up": 100,
    "speed-limit-up-enabled": false,
    "start-added-torrents": true,
    "trash-original-torrent-files": false,
    "umask": 2,
    "upload-limit": 100,
    "upload-limit-enabled": 0,
    "upload-slots-per-torrent": 14,
    "utp-enabled": true
}

If you don't know what you are doing, please leave the default settings.

Things to change:

The download directory should be /home/transmission/downloads

Code: Select all

"download-dir": "/home/transmission/downloads",

The temporary directory should be /home/transmission/transmission-temp

Code: Select all

"incomplete-dir": "/home/transmission/transmission-temp",

Type in a new password, or just use "transmission" for simplicity. Please note that the password will be encrypted when Transmission starts again, so please don't forget it.

Code: Select all

"rpc-password": "transmission",

The whitelist allows all localhost connections and also connection from all computers on the LAN.

Code: Select all

"rpc-whitelist": "127.0.0.1,192.168.*.*",

If you want more restrictive access, you can for instance use an individual LAN address that you can connect to the server from. Please be careful if doing this, as too restrictive rules may get locked out.

When you are all done editing, press Ctrl+x to exit and save the changes.

We will alter permissions for /home/transmission and all sub-directories to make it possible to save and fetch files there.


8.2 Setting permissions

Transmission is running as debian-transmission, so reading and writing to transmission can be an issue. The same goes for any user on your host computer. Therefore we'll add the necessary users to a group with the correct permissions:

Create the group:

Code: Select all

# addgroup transmissiongroup

Add users to the group:

Code: Select all

# adduser debian-transmission transmissiongroup
# adduser transmission transmissiongroup

Then add the user(s) of your remote computer that you'll be using to add or delete files in /home/transmission, in my case:

Code: Select all

# adduser hallvor transmissiongroup

Set the group for the transmission directory

Code: Select all

# chown -R :transmissiongroup /home/transmission

Give the group read, write and execute permissions to /home/transmission

Code: Select all

# chmod -R 770 /home/transmission

Ensure that files created in the directory inherits the group ownership of the parent directory. Whenever files are put in /home/transmission, all users in transmissiongroup will have access:

Code: Select all

# chmod -R g+s /home/transmission

9. Firewall

If the server is behind a router's firewall, you may need to open and forward the range 49152 to 65535 to your server. If you don't know how, this page is excellent: https://portforward.com/ Then follow the instructions.


9.1 nftables

If the server itself has an active firewall, you can add the entire range like this (nftables):

Code: Select all

# nft add rule inet filter input tcp dport 9091 accept
# nft add rule inet filter input udp dport 9091 accept
# nft add rule inet filter input tcp dport {49152-65535} accept
# nft add rule inet filter input udp dport {49152-65535} accept

Check that the rules are added:

Code: Select all

# nft list ruleset

Reload nftables with the new settings

Code: Select all

# systemctl restart nftables.service

9.2 UFW

If you use UFW:

Code: Select all

# ufw allow 9091/tcp
# ufw allow 9091/udp
# ufw allow 49152:65535/tcp
# ufw allow 49152:65535/udp
# ufw reload

All done! It is probably a good idea to reboot your server at this point to see how the system behaves after a normal reboot.


10. Reboot and testing

Code: Select all

# systemctl reboot

Log back into the server with (assuming that your LAN IP is 192.168.1.10)

Code: Select all

$ ssh root@192.168.1.10

Enter your root password

Check that transmission-daemon.service is running

Code: Select all

# systemctl status transmission-daemon.service

You should see something like this:

Code: Select all

root@rpi2-20220121:~# systemctl status transmission-daemon.service
● transmission-daemon.service - Transmission BitTorrent Daemon
     Loaded: loaded (/lib/systemd/system/transmission-daemon.service; enabled; preset: enabled)
     Active: active (running) since Wed 2024-01-24 03:00:44 UTC; 6h ago
   Main PID: 425 (transmission-da)
     Status: "Uploading 33.88 KBps, Downloading 1.07 KBps."
      Tasks: 4 (limit: 1995)
     Memory: 471.7M
        CPU: 9min 26.266s
     CGroup: /system.slice/transmission-daemon.service
             └─425 /usr/bin/transmission-daemon -f --log-error

Jan 24 03:00:42 rpi2-20220121 systemd[1]: Starting transmission-daemon.service - Transmission BitTorrent Daemon...
Jan 24 03:00:44 rpi2-20220121 systemd[1]: Started transmission-daemon.service - Transmission BitTorrent Daemon.
Jan 24 03:00:45 rpi2-20220121 transmission-daemon[425]: [2024-01-24 03:00:45.608] UDP Failed to set receive buffer: requested 4194304, got 360448 (tr-udp.c:97)
Jan 24 03:00:45 rpi2-20220121 transmission-daemon[425]: [2024-01-24 03:00:45.608] UDP Failed to set send buffer: requested 1048576, got 360448 (tr-udp.c:105)
root@rpi2-20220121:~# 

As shown, it complains that the send and receive buffers are too low. Let's give Transmission a little more space by increasing the buffer size. NOTE: Please beware that modifying system parameters can have consequences. If you experience any problems, please undo these changes by removing the values added to /etc/sysctl.conf below.

Code: Select all

# nano /etc/sysctl.conf

Paste this to the bottom if the file

Code: Select all

net.core.rmem_max = 16777216
net.core.wmem_max = 4194304

Save and close with Ctrl+x.

Apply the changes

Code: Select all

# sysctl -p

Let's try again:

Code: Select all

# systemctl status transmission-daemon.service

Code: Select all

root@rpi2-20220121:~# systemctl status transmission-daemon.service
● transmission-daemon.service - Transmission BitTorrent Daemon
     Loaded: loaded (/lib/systemd/system/transmission-daemon.service; enabled; preset: enabled)
     Active: active (running) since Wed 2024-01-24 09:31:49 UTC; 12s ago
   Main PID: 3532 (transmission-da)
     Status: "Uploading 19.74 KBps, Downloading 0.58 KBps."
      Tasks: 3 (limit: 1995)
     Memory: 5.0M
        CPU: 1.647s
     CGroup: /system.slice/transmission-daemon.service
             └─3532 /usr/bin/transmission-daemon -f --log-error

Much better!

If the service isn't running, you should see info on why it failed to start.


10. Troubleshooting

Check the server for configuration errors and get detailed information for each entry.


10.1 View all logs related to transmission

Code: Select all

# journalctl -u transmission-daemon.service

10.2 If you only want to view error messages

Code: Select all

# journalctl -u transmission-daemon.service -p err

10.3 If you are having problems, but transmission seems OK, you can check for system wide errors

Code: Select all

# journalctl -p err -xe

If there are no problems, the file should show "-- No entries --"


11. Connecting from a Web interface

Just type your server's IP and rpc-port from the configuration file in a Web browser like Firefox or Chromium (The default port is 9091.)

For instance: http://192.168.1.10:9091

If everything works correctly, you will be prompted to insert your username and password. Username should be transmission, and if you didn't alter your password earlier, you can input transmission as password too.

The network interface should be easy to follow, so just click the folder to drop a magnet link or a torrent-file, and the server will do the rest.


12. Connecting from an Android mobile phone

You can also download the Android app, where you also can add torrents/watch progress of files and even get a notifications on your phone when files are downloaded.

Find the app on Google Play or click the link below:

https://play.google.com/store/apps/deta ... ission.btc

Just add the server's address, port and password, and you should see the server. You are now ready to download and share files:


13. Ideas for use

Please consider helping Debian with distributing CD/DVD images files: https://www.debian.org/CD/torrent-cd/


The Internet Archive also features millions of files that can be shared and distributed if you select "Torrent": https://archive.org/


Help seeding GNU/Linux distros on Linuxtracker: https://linuxtracker.org


14. Moving files

14.1 KDE Plasma
I prefer adding a network folder in KDE's Dolphin, so that I can browse it's folders as if they were local: Open Dolphin, click the Network on the left pane. Then click the "Add Network Folder" button on the top right. Select the SSH option and type the address to your server (for instance 192.168.1.10), login (transmission) and the transmission user's password.

14.2 Gnome
Disclaimer: I have not tested this part. Open Dolphin, click "Other Locations" in the top menu. At the bottom of the sidebar, click "Connect to server". Select SSH from the drop-down menu, and then enter the address to your server (for instance 192.168.1.10) and login name (transmission). Click "Connect" and you will be prompted for the transmission user's password.

14.3 From the command line interface
Copying a local file to the remote server from your computer

Code: Select all

scp /path/to/local/file transmission@192.168.1.10:/path/to/remote/directory

Copying a remote file from the server to your computer

Code: Select all

scp transmission@192.168.1.10:/path/to/remote/file /path/to/local/directory

Copying an entire local directory to the server

Code: Select all

scp -r /path/to/local/directory transmission@192.168.1.10:/path/to/remote/

Copying an entire remote directory to your computer

Code: Select all

scp -r transmission@192.168.1.10:/path/to/remote/directory /path/to/local/

Replace paths as needed.


15. Conclusion

This guide has walked you through setting up a Debian torrent server using Transmission. With a focus on security and efficiency, the headless server configuration should ensure a reliable long term file sharing experience with easy web and phone management. Keep security in mind, use strong passwords, and regularly update your system.

Suggestions for improvement of this guide are always welcome.



Update 25.01.24: Added info on permissions and shared /home/transmission directory

[bbbhltz]

Not that anyone would ever download anything tha isn't already free, like a Debian ISO (you wouldn't download a car, would you?) I recommend using a Blocklist.

Many sites will point users to this repo: https://github.com/Naunter/BT_BlockLists

[Hallvor]

[...] I recommend using a Blocklist.

I know a man who decided to block the entire US in the belief that this would "save" him from the clutches of different four letter associations hunting illegal file sharers. My comment to this man was that that he likely just blocked many good peers.

The assumption that lists such as these will "help" you, presupposes that the agencies, lawyer firms, etc. you want to block, are technically inept. They are not. They seem to have the technical skill to make modified clients that connect to torrent swarms and harvest all IPs of seeders and leechers, but we are to believe that they don't have the technical skill to use a VPN while doing so?

If you want to be "safe", you have two options:
1. Don't use this for illegal activity, or
2. block all IPs

[bbbhltz]

@Hallvor well, of course they know. But, blocking some peers can even speed up your transfer as some companies run clients with intentionally bad data and try to share it, or clients that make too many connections per second which is not normal behaviour. I do not have some blazing-fast fibre-optic connection, so even taking out one intentionally slow or fraudulent client is the difference between watching that film before dinner installing that Debian ISO before dinner, or after.

[Hallvor]

@bbbhltz I guess it depends what you download, but I can certainly see scenarios where things like that would happen. Having said that, I can't remember this ever being a problem on my blazing-fast fibre-optic connection...