Question

I have Rstudio running on my desktop, and I can access it from the web at http://my.desktop:8787.

From the Rstudio documentation, it appears that setting up a reverse proxy is a prudent security measure (please correct me if I am wrong).

I am using Ubuntu 11.04

In following the instructions for that page, I have installed ngnix and added the code snippets to /etc/nginx/nginx.conf:

http {
  server {
    listen 80;

    location / {
      proxy_pass http://localhost:8787;
      proxy_redirect http://localhost:8787/ $scheme://$host/;
    }
  }
}

sudo nginx restart -v returns the following error:

nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)

Furthermore, if I include the following snippet (so that the link is to /rstudio instead of :8787):

location /rstudio/ {
  rewrite ^/rstudio/(.*)$ /$1 break;
  proxy_pass http://localhost:8787;
  proxy_redirect http://localhost:8787/ $scheme://$host/rstudio/;
}

sudo nginx restart -v returns the following error:

Restarting nginx: nginx: [emerg] unknown directive "location" in 
/etc/nginx/nginx.conf:93

I have two questions:

1. How necessary is a reverse proxy server if I use a strong password?
2. How can I get past these errors?

Answer 1

It looks like port 80 is already in use. Based on the interchanged “Apache” and “Nginx” in your title/question, I’m guessing you may have two web servers running.

I’ll assume you want to pick Nginx and use that one, as that’s what you’re configuring. If that’s the case, you’ll want to shutdown Apache. (sudo /etc/init.d/httpd stop or sudo /etc/init.d/apache2 stop — you’ll have to look in /etc/init.d/ to see what service Apache runs as in Ubuntu).

Then try restarting nginx to see if that fixes error #1.

Regarding your first question, it is certainly a good idea to use a reverse proxy for security purposes, and it actually has nothing to do with the strength of your passwords. RStudio was not designed to be a web server, so there are bound to be a variety of vulnerabilities in it which are undiscovered — in part because it’ a new project, and in part because it’s not designed to be a solid web-server. Apache or nginx, on the other hand, are specially designed and hardened to be able to be exposed to public networks (such as the Internet) without jeopardizing the security of your system. So you’ll work with it the same (in terms of usernames and passwords), but you’ll be less vulnerable to advanced attacks from the external network.

Keep in mind, as well, that the primary purpose of having a reverse proxy in place is so that the only publicly exposed service on your machine is Apache/Nginx — so be sure to configure your firewall to block port 8787; otherwise, there’s no point in configuring a reverse proxy.