Setting up a CTF platform

There are two main CTF platforms in public use:

rCTF (you are here!)
CTFd

This guide focuses on rCTF, but the setup looks similar on either platform.

Prerequisites#

For this guide, you’ll need at least the following:

A domain name to host your CTF platform and challenges on (e.g. example.com)
A VPS to host the CTF platform from any provider (Hetzner, Vultr, DigitalOcean, GCP, AWS, etc.), preferably with at least 2 cores and 4 GiB RAM. The guide uses Ubuntu 24.04, but you are free to also use any other preferred OS of choice.

You’ll also want a TLS certificate, either through Cloudflare with a proxied host or through certbot for manual provisioning.

Note

All the examples will use example.com which refers to the domain name hosting the CTF platform, and 123.123.123.123 which is the deployed VPS hosting the CTF platform. All these occurrences should be replaced with your own values respectively.

Installing rCTF#

SSH into your VPS

After you’ve deployed a VPS in your preferred provider, you’ll need to SSH into it using:

$ssh root@123.123.123.123

All the subsequent commands should be run inside the VPS as the root user.

Run the installation script

We provide a simple installation script that sets up rCTF automatically:

$curl -L https://get.rctf.osec.io | sh

When prompted if rCTF should be started, answer y. The installation script configures rCTF into the /opt/rctf/ directory which will contain all of our rCTF configuration and from which commands to restart rCTF should be run.

Configure your instance

The /opt/rctf/rctf.d/ folder contains the configuration files where your instance can be customized, and you can find more instructions here. Consider configuring at least the following:

CTF name, description, image, origin, home content, start and end time
Email configuration if you want to verify emails (do note that certain providers have manual verification steps before you can send emails, so this should be done well in advance)
proxy.cloudflare if behind Cloudflare
GCS for storing challenges to decrease the load on the CTF platform (see instructions here)

Restart rCTF after configuration changes

After each configuration change, you need to restart rCTF by running the following command:

$cd /opt/rctf && docker compose up -d --force-recreate --build

Setting up the web server#

By default, the CTF platform is only accessible from the VPS itself. To expose it, set up Nginx as a webserver that handles TLS and proxies traffic to rCTF. Putting Cloudflare in front of that also helps with DDoS attacks and gives you easy rate-limiting.

Configure Cloudflare DNS

In Cloudflare, navigate to your domain > DNS > Records and create an A record pointing to 123.123.123.123 (your VPS IP). The orange cloud should be enabled. Then, navigate to the SSL/TLS > Overview tab, and make sure SSL/TLS encryption is set to Full (strict).

Create origin certificate

In SSL/TLS > Origin Server tab, create a new certificate where all the settings are default except the hostname is set to the domain name where you’ll run the CTF platform, e.g. ctf.example.com. Copy the origin certificate into the /etc/ssl/cf_fullchain.pem file, and the private key into the /etc/ssl/cf_privkey.pem file.

Configure UFW firewall

We will setup a firewall using UFW to only allow Cloudflare IPs to access the web server:

$ufw allow 22
# source: https://github.com/Paul-Reed/cloudflare-ufw/blob/master/cloudflare-ufw.sh
$for cfip in `curl -sw '\n' https://www.cloudflare.com/ips-v{4,6}`; do ufw allow proto tcp from $cfip comment 'Cloudflare IP'; done
$ufw enable   # answer `y` when prompted regarding enabling firewall

Install and configure Nginx

Install Nginx using apt update && apt install -y nginx. Then, create /etc/nginx/sites-available/rctf.conf with the following contents (note the comments on stuff you need to update):

1
# Redirect HTTP -> HTTPS
2
server {
3
    listen 80;
4
    server_name ctf.example.com; # TODO: update me to CTF platform domain name
5
    return 301 https://$host$request_uri;
6
}
7

8
map $http_upgrade $connection_upgrade {
9
    default upgrade;
10
    ''  close;
11
}
12

13
server {
14
    listen 443 ssl;
15
    server_name ctf.example.com; # TODO: update me to CTF platform domain name
16
    ssl_certificate /etc/ssl/cf_fullchain.pem;
17
    ssl_certificate_key /etc/ssl/cf_privkey.pem;
18

19
    # NOTE: It is *very* important to only whitelist Cloudflare IPs for the webserver (which we'll do in the following steps),
20
    # as this otherwise lets you spoof the IP.
21
    set_real_ip_from 0.0.0.0/0;
22
    real_ip_header CF-Connecting-IP;
23

24
    location / {
25
        # Uncomment the following if you want to only allow yourself to access the platform for now.
26
        #allow [your IP];
27
        #deny all;
28

29
        proxy_set_header Host $host;
30
        proxy_set_header X-Real-IP $remote_addr;
31
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
32
        proxy_set_header X-Forwarded-Proto $scheme;
33
        proxy_http_version 1.1;
34
        proxy_set_header Upgrade $http_upgrade;
35
        proxy_set_header Connection $connection_upgrade;
36
        proxy_pass http://127.0.0.1:8080/;
37
        proxy_buffering off;
38
    }
39
}

Enable the configuration

Create a symlink so Nginx loads the configuration, then apply it:

$ln -s /etc/nginx/sites-available/rctf.conf /etc/nginx/sites-enabled/rctf.conf
$nginx -t && nginx -s reload

Every time you update the configuration, run nginx -t && nginx -s reload to validate and apply changes. After all these steps, you should be able to visit https://ctf.example.com and view rCTF!

Configure DNS

In your DNS registrar, configure a new A DNS record pointing to 123.123.123.123 (your VPS IP). Then, follow the instructions on certbot’s website on how to provision a certificate.

Install and configure Nginx

Install Nginx using apt update && apt install -y nginx. Then, create /etc/nginx/sites-available/rctf.conf with the following contents (note the comments on stuff you need to update):

1
# Redirect HTTP -> HTTPS
2
server {
3
    listen 80;
4
    server_name ctf.example.com; # TODO: update me to CTF platform domain name
5
    return 301 https://$host$request_uri;
6
}
7

8
map $http_upgrade $connection_upgrade {
9
    default upgrade;
10
    ''  close;
11
}
12

13
server {
14
    listen 443 ssl;
15
    server_name ctf.example.com; # TODO: update me to CTF platform domain name
16
    ssl_certificate /etc/letsencrypt/live/ctf.example.com/fullchain.pem; # TODO: update path to CTF platform domain name
17
    ssl_certificate_key /etc/letsencrypt/live/ctf.example.com/privkey.pem; # TODO: update path to CTF platform domain name
18

19
    location / {
20
        # Uncomment the following if you want to only allow yourself to access the platform for now.
21
        #allow [your IP];
22
        #deny all;
23

24
        proxy_set_header Host $host;
25
        proxy_set_header X-Real-IP $remote_addr;
26
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
27
        proxy_set_header X-Forwarded-Proto $scheme;
28
        proxy_http_version 1.1;
29
        proxy_set_header Upgrade $http_upgrade;
30
        proxy_set_header Connection $connection_upgrade;
31
        proxy_pass http://127.0.0.1:8080/;
32
        proxy_buffering off;
33
    }
34
}

Enable the configuration

Create a symlink so Nginx loads the configuration, then apply it:

$ln -s /etc/nginx/sites-available/rctf.conf /etc/nginx/sites-enabled/rctf.conf
$nginx -t && nginx -s reload

Every time you update the configuration, run nginx -t && nginx -s reload to validate and apply changes. After all these steps, you should be able to visit https://ctf.example.com and view rCTF!

Creating an admin account#

Update permissions via database

In the VPS running rCTF, run the following commands to grant the account admin permissions:

$docker exec -it rctf-postgres-1 bash

$psql -U rctf

UPDATE users SET perms = 3 WHERE email = 'my.email@example.com';

Verify admin access

Confirm that you have permissions to create challenges by navigating to https://ctf.example.com/admin/challs.

Warning

If the page does not load or you don’t see the challenge upload screen, something went wrong and you should double check the output of the previous commands when updating your permissions.