Deluge on Debian - default access rights

General support for problems installing or using Deluge
fred44nl
Member
Member
Posts: 32
Joined: Mon Feb 20, 2017 10:59 am

Deluge on Debian - default access rights

Post by fred44nl »

hey, hello,
My media-server runs Debian 13 - trixie, and is fully updated.
As the internal SSD was going bad, I installed a new SSD and did a new install of Debian.
This included also installing Deluge, and it is working well.
During the installation of Deluge, there was a new user-group, named debian-deluged.
I did add myself to that group.

Code: Select all

debian-deluged:x:988:fred44nl
The service-file of Deluge is this:

Code: Select all

fred44nl@Debian:~$ sudo cat /etc/systemd/system/deluged.service
[Unit]
Description=Deluge Bittorrent Client Daemon
Documentation=man:deluged
After=network-online.target

[Service]
Type=simple
User=fred44nl
Group=debian-deluged
UMask=000
ExecStart=/usr/bin/deluged -d
Restart=on-failure
# Time to wait before forcefully stopped.
TimeoutStopSec=300

[Install]
WantedBy=multi-user.target
The downloaded files are going to the correct folder, but they have the following access-rights and owner:

Code: Select all

-rw-rw----  1 debian-deluged debian-deluged 791674880  4 aug 13:52 debian-13.6........
This means that the regular user of the server, which is me, can not do very much with these downloaded files.

How can I change the settings, so that the downloaded files gets -rw-rw-rw as access-rights and owner fred44nl:fred44nl ?
User avatar
ambipro
Moderator
Moderator
Posts: 782
Joined: Thu May 19, 2022 3:33 am
Contact:

Re: Deluge on Debian - default access rights

Post by ambipro »

Change UMask to 0002

Then do

Code: Select all

systemctl daemon-reload
systemctl restart deluged
fred44nl
Member
Member
Posts: 32
Joined: Mon Feb 20, 2017 10:59 am

Re: Deluge on Debian - default access rights

Post by fred44nl »

thank you
I assume you mean 002 and not 0002
UMAsk=002 gives -rw-rw-r---
shinger
Seeder
Seeder
Posts: 195
Joined: Sat Jun 05, 2010 1:02 pm

Re: Deluge on Debian - default access rights

Post by shinger »

Hi Fred,

I would rather say turn things around.

Instead of your user, put the user to debian-deluged as owner/user and and then use a group that you can add your own user to it (for example group community). That way you create the flexibility for the future also. If another user or service needs access to it (even be able to write to it), you can simply add the user to that community group and job is done. If you don't want the user to have write access to it, the last bit of umask has a 2 (which will become a 5 with chmod), so it has read + execute access to the directories and you don't have to change anything.

To be on the safe side that the directories that are created do belong to this so called community group, just use sticky bit (chmod g+s <deluge download directory>. (If you might not know what it stands for or for other readers reading this topic having same issue, g stands for group and s stands for sticky. That way any directory that is being created will have the correct group name.
===============================================================
Server: Rock 5B 8 Cores (ARM), 16 GB RAM, 2 TB 970 Evo +
OS: Linux Ubuntu 24.04 LTS
Deluge: v2.2.0
Plugins: Blocklist, LabelPlus, ItConfig, MyScheduler, Stats, Notifications, YaRSS2
fred44nl
Member
Member
Posts: 32
Joined: Mon Feb 20, 2017 10:59 am

Re: Deluge on Debian - default access rights

Post by fred44nl »

thank you, but you lost me there, all together.

I used ACL like this:

Code: Select all

sudo setfacl -m d:g:debian-deluged:rwX /mnt/usbhdd/Torrent
this gives me -rw-rw-rw- access-rights.
shinger
Seeder
Seeder
Posts: 195
Joined: Sat Jun 05, 2010 1:02 pm

Re: Deluge on Debian - default access rights

Post by shinger »

Well, what i meant to say is the following. If we for example take your deluged service file. I edited to show it should be.

Code: Select all

fred44nl@Debian:~$ sudo cat /etc/systemd/system/deluged.service
[Unit]
Description=Deluge Bittorrent Client Daemon
Documentation=man:deluged
After=network-online.target

[Service]
Type=simple
User=debian-deluged
Group=community
UMask=002
ExecStart=/usr/bin/deluged -d
Restart=on-failure
# Time to wait before forcefully stopped.
TimeoutStopSec=300

[Install]
WantedBy=multi-user.target
- You create a new group (in this example it is called community. You can off course choose a different name)
groupadd community
- In the systemd unit file (deluged.service) see above, you use this group to be used
- You add your user to this group.
usermod -aG community fred44nl
To see if the user is part of the group, type the following command.
groups fred44nl
- If in the future there is a user called mark and he also needs to have the same access as fred44nl, then you simply add him to that community group. So this way you also make sure you made your configuration flexible for the future if the situation might change with new users. Always try to think ahead, this saves a lot of headaches..speaking from experience :D
- The umask setting how it was, in your first post was dirty beyond words (000)...how you had in your systemd unit file as that translates to 777 (which means everybody that has an account on your system can delete all those files that have been created by deluge. Ambipro pointed this out, by advising to use 002 (which translates 775)(which means in normal language, owner can do everything, group can do everything, other (everyone else) can just read). But if you did it on purpose of having 777, that defeats the purpose of having your user to be used in the systemd unit file as you can do exactly the same through other bit.

For you, but also for other readers, i would strongly advice to try to understand Linux file permissions. Often people don't understand them, as they don't take the time to understand them...(yes i was also one of those people and yes i back in the day also used 777 until i took the time, so i am not pointing fingers :lol: ). https://linuxize.com/post/understanding ... rmissions/

Doing this, just fixes your problem.

About ACL's, don't. ACL's have their place to be used, but that is in MAYBE less than 5% percent of the cases? If not less. I am saying this as i work in the Linux and Open Source world. I ONLY implemented this once with a customers environment as there was no other way. Only once of all those years.
===============================================================
Server: Rock 5B 8 Cores (ARM), 16 GB RAM, 2 TB 970 Evo +
OS: Linux Ubuntu 24.04 LTS
Deluge: v2.2.0
Plugins: Blocklist, LabelPlus, ItConfig, MyScheduler, Stats, Notifications, YaRSS2
fred44nl
Member
Member
Posts: 32
Joined: Mon Feb 20, 2017 10:59 am

Re: Deluge on Debian - default access rights

Post by fred44nl »

thank you for your extensive reply.
I understand your concern about access-rights 777
but I own my server and there are no other users and there will never be.
I did follow your suggestion to make an new group, which I did call “download”
and I did make the changes to /etc/systemd/system/deluged.service
the consequence of a new user and group in /etc/systemd/system/deluged.service, means that all the settings, which are set in Deluge-Web, are gone.
so, I went back to user:group fred44nl:debian:deluged
and of course UMAsk=002
and yes, I did remove the ACL.
as far as I can see now, everything is working well.
User avatar
ambipro
Moderator
Moderator
Posts: 782
Joined: Thu May 19, 2022 3:33 am
Contact:

Re: Deluge on Debian - default access rights

Post by ambipro »

If i recall 0002 and 002 are the same, and should result in files get 0664, dirs get 0775
shinger
Seeder
Seeder
Posts: 195
Joined: Sat Jun 05, 2010 1:02 pm

Re: Deluge on Debian - default access rights

Post by shinger »

fred44nl wrote: Fri Aug 07, 2026 4:15 pm thank you for your extensive reply.
I understand your concern about access-rights 777
but I own my server and there are no other users and there will never be.
I did follow your suggestion to make an new group, which I did call “download”
and I did make the changes to /etc/systemd/system/deluged.service
the consequence of a new user and group in /etc/systemd/system/deluged.service, means that all the settings, which are set in Deluge-Web, are gone.
so, I went back to user:group fred44nl:debian:deluged
and of course UMAsk=002
and yes, I did remove the ACL.
as far as I can see now, everything is working well.
Its not about you owning those servers. Its about security. At home i also own everything and only few users exist that i use for all kind of services.

For us (you, me and many others) we like to have control over our data, but also about what to use and how to use it. Often it is not only applications like Deluge, but we have a complete self hosted infrastructure. Hackers, bots etc they are at it, day in day out. When the others bit is on 7, it means ANY user that has access to your machine, can delete/change those files. This includes www-data user. If you have a website or decided to host also a website at home (used by Nginx/Apache webservice). Which means if they have control over this user, it can reach those files.

Let me give you an example at home. This is just a portion of the bots trying to scan for vulnerabilities. Majority of the application infrastructure of others doesn't even come close to mine. This includes even companies, but as you see i am also not safe as they also keep scanning mine.

Linux is becoming a more and more of a big player with even consumers these days, because of costs, privacy and security reasons that we don't trust companies with our data. So all i am saying is we should take the Linux sysadmin tasks also a bit more seriously. And yes its a hassle to do it, but its not like you are on your own. People like ambipro, me and many others are more than willing to spend our free time to help. Companies pay us for our expertise, but we give our expertise all for free away to normal people that need help. So if you have any questions or help, just fire away :D .

Code: Select all

<USER>@<SYSTEM>:/var/log/haproxy# journalctl -u haproxy.service -n 1000000 | grep -Ev "<EXCLUDE>|<EXCLUDE>|<EXCLUDE>" | grep 404 | wc -l
16427
4.232.90.10 - https://www.abuseipdb.com/check/4.232.90.10
168.76.20.229 - https://www.abuseipdb.com/check/168.76.20.229
80.94.95.211 - https://www.abuseipdb.com/check/80.94.95.211

Code: Select all

Jul 26 06:30:42 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:42 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:42.141] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /i.php HTTP/1.1"                                                                                                                                                                                                                                      06:57 [744/1878]
Jul 26 06:30:42 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:42 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:42.185] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /wp-content/uploads/ HTTP/1.1"
Jul 26 06:30:42 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:42 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:42.230] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /wp-includes/Requests/library/index.php HTTP/1.1"
Jul 26 06:30:42 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:42 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:42.274] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /wp-content/themes/index.php HTTP/1.1"
Jul 26 06:30:42 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:42 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:42.327] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /gecko-new.php HTTP/1.1"
Jul 26 06:30:42 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:42 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:42.378] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /NewFile.php HTTP/1.1"
Jul 26 06:30:42 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:42 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:42.449] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /wp-Blogs.php HTTP/1.1"
Jul 26 06:30:42 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:42 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:42.500] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /wp-includes/fonts/index.php HTTP/1.1"
Jul 26 06:30:42 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:42 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:42.574] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /themes.php HTTP/1.1"
Jul 26 06:30:42 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:42 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:42.626] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /cv.php HTTP/1.1"
Jul 26 06:30:42 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:42 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:42.690] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /wp-admin/js/ HTTP/1.1"
Jul 26 06:30:42 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:42 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:42.767] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /wp-content/uploads/index.php HTTP/1.1"
Jul 26 06:30:42 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:42 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:42.818] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /ws83.php HTTP/1.1"
Jul 26 06:30:42 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:42 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:42.889] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /atex1.php HTTP/1.1"
Jul 26 06:30:42 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:42 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:42.943] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /class-t.api.php HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.007] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /w.php HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.058] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /archive.php HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.102] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /bless.php HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.146] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /sagax1.php HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.202] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /wpc.php HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.269] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /fone1.php HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.318] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /ncx.php HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.366] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /wp-admin/js/index.php HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.410] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /wso.php HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.469] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /zup.php73 HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.550] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /k.php HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.610] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /wp-blink.php HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.667] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /randkeyword.PhP7 HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.711] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.774] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /wp-content/ HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.846] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /ww5.php HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.895] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /2.php HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.938] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /wp-admin/classwithtostring.php HTTP/1.1"
Jul 26 06:30:43 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:43 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:43.983] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /atomlib.php HTTP/1.1"
Jul 26 06:30:44 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:44 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:44.027] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /rip.php HTTP/1.1"
Jul 26 06:30:44 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:44 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:44.071] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /p.php HTTP/1.1"
Jul 26 06:30:44 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:30:44 haproxy[1352589]: 4.232.90.10:53464 [26/Jul/2026:06:30:44.114] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 8/5/0/0/0 0/0 {<DOMAIN>} "GET /php.php HTTP/1.1"
Jul 26 06:42:33 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:42:33 haproxy[1352589]: 168.76.20.229:16251 [26/Jul/2026:06:42:33.944] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 9/6/0/0/0 0/0 {<PUBLIC_IP>:443} "GET / HTTP/1.1"
Jul 26 06:42:34 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:42:34 haproxy[1352589]: 168.76.20.229:46168 [26/Jul/2026:06:42:34.776] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 9/6/0/0/0 0/0 {<PUBLIC_IP>:443} "GET / HTTP/1.1"
Jul 26 06:42:35 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:42:35 haproxy[1352589]: 168.76.20.229:19959 [26/Jul/2026:06:42:35.551] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 9/6/0/0/0 0/0 {<PUBLIC_IP>:443} "GET /favicon.ico HTTP/1.1"
Jul 26 06:42:36 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:42:36 haproxy[1352589]: 168.76.20.229:12447 [26/Jul/2026:06:42:36.223] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 9/6/0/0/0 0/0 {<PUBLIC_IP>:443} "GET /robots.txt HTTP/1.1"
Jul 26 06:51:38 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:51:38 haproxy[1352589]: 80.94.95.211:37015 [26/Jul/2026:06:51:38.305] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 7/4/0/0/0 0/0 {<PUBLIC_IP>:443} "GET /.env HTTP/1.1"
Jul 26 06:51:38 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:51:38 haproxy[1352589]: 80.94.95.211:37015 [26/Jul/2026:06:51:38.339] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 7/4/0/0/0 0/0 {<PUBLIC_IP>:443} "GET /.env.php HTTP/1.1"
Jul 26 06:51:38 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:51:38 haproxy[1352589]: 80.94.95.211:37015 [26/Jul/2026:06:51:38.373] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 7/4/0/0/0 0/0 {<PUBLIC_IP>:443} "GET /.env.sample.php HTTP/1.1"
Jul 26 06:51:38 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:51:38 haproxy[1352589]: 80.94.95.211:37015 [26/Jul/2026:06:51:38.406] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 7/4/0/0/0 0/0 {<PUBLIC_IP>:443} "GET /.env.local.php HTTP/1.1"
Jul 26 06:51:38 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:51:38 haproxy[1352589]: 80.94.95.211:37015 [26/Jul/2026:06:51:38.441] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 7/4/0/0/0 0/0 {<PUBLIC_IP>:443} "GET /.env.production.php HTTP/1.1"
Jul 26 06:51:38 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:51:38 haproxy[1352589]: 80.94.95.211:37015 [26/Jul/2026:06:51:38.474] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 7/4/0/0/0 0/0 {<PUBLIC_IP>:443} "GET /config.dev.php HTTP/1.1"
Jul 26 06:51:38 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:51:38 haproxy[1352589]: 80.94.95.211:37015 [26/Jul/2026:06:51:38.508] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 7/4/0/0/0 0/0 {<PUBLIC_IP>:443} "GET /config.env HTTP/1.1"
Jul 26 06:51:38 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:51:38 haproxy[1352589]: 80.94.95.211:37015 [26/Jul/2026:06:51:38.542] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 7/4/0/0/0 0/0 {<PUBLIC_IP>:443} "GET /twilio/.env.php HTTP/1.1"
Jul 26 06:51:38 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:51:38 haproxy[1352589]: 80.94.95.211:37015 [26/Jul/2026:06:51:38.576] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 7/4/0/0/0 0/0 {<PUBLIC_IP>:443} "GET /config/.env.php HTTP/1.1"
Jul 26 06:51:38 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:51:38 haproxy[1352589]: 80.94.95.211:37015 [26/Jul/2026:06:51:38.610] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 7/4/0/0/0 0/0 {<PUBLIC_IP>:443} "GET /sendgrid/.env.php HTTP/1.1"
Jul 26 06:51:38 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:51:38 haproxy[1352589]: 80.94.95.211:37015 [26/Jul/2026:06:51:38.643] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 7/4/0/0/0 0/0 {<PUBLIC_IP>:443} "GET /.env.php.bak HTTP/1.1"
Jul 26 06:51:38 <FQDN-HOST> haproxy[1352589]: <134>Jul 26 06:51:38 haproxy[1352589]: 80.94.95.211:37015 [26/Jul/2026:06:51:38.678] web_external~ backend_404/<NOSRV> 0/-1/-1/-1/0 404 0 - - PR-- 7/4/0/0/0 0/0 {<PUBLIC_IP>:443} "GET /.env.php-bak HTTP/1.1"
===============================================================
Server: Rock 5B 8 Cores (ARM), 16 GB RAM, 2 TB 970 Evo +
OS: Linux Ubuntu 24.04 LTS
Deluge: v2.2.0
Plugins: Blocklist, LabelPlus, ItConfig, MyScheduler, Stats, Notifications, YaRSS2
User avatar
ambipro
Moderator
Moderator
Posts: 782
Joined: Thu May 19, 2022 3:33 am
Contact:

Re: Deluge on Debian - default access rights

Post by ambipro »

So I just opened my pfSense firewall logs, and this is a glimpse of how much traffic is rejected. Bots are, as shinger says, constantly scanning for open ports, 22 being a main one as its SSH's default. I change my SSH port immediately when I provision a new server or vm.

Image


Not all of these are malicious, but a large majority are and can be probing for open ports on vulnerable services that a new CVE has just been released or a proof-of-concept was just made public.

Be vigilant about your security so you don't have to be regretful about your lack of concern for security :)

This is only a few minutes of the logs, imagine what's going on over the course of hours or days.
Post Reply