SHOUTcast server on Linux: installing and configuring DNAS 2

What sc_serv asks of the machine

sc_serv does not encode audio. It takes an already-encoded stream from a source (BUTT, Mixxx, sc_trans, the Winamp DSP) and hands copies to listeners, repackaging SHOUTcast 1 and SHOUTcast 2 data for whichever client connects. Shoutcast publishes builds for Linux and Windows, 32-bit and 64-bit. The DNAS documentation names three ceilings on concurrent listeners: the maxuser setting, the operating system's connection limit and the bandwidth you have.

Bandwidth is bitrate times listeners. The table is that arithmetic, ours rather than a Shoutcast figure, and it leaves out TCP and HTTP overhead.

maxuser defaults to 32. A fresh install with the default config turns away listener 33. The docs also report a ceiling of around 1016 connections on non-Windows systems when the open-file limit is left as it is; raise it with ulimit -n or, under systemd, LimitNOFILE.

Installing on Ubuntu

The Shoutcast Basic page offers the software for free, but the licence agreement requires you to register as a Shoutcast member before using it. Take the Linux 64-bit archive. The steps below are our recommendation, not part of Shoutcast's documentation: a system user and directory of its own so nothing runs as root (port 8000 is above 1024, so root is never needed), and the firewall up before the first start.

sudo useradd --system --create-home --home-dir /opt/shoutcast --shell /usr/sbin/nologin shoutcast
sudo -u shoutcast tar -xzf /tmp/<the-archive-you-downloaded>.tar.gz -C /opt/shoutcast
sudo -u shoutcast mkdir -p /opt/shoutcast/logs /opt/shoutcast/control
sudo chmod a+x /opt/shoutcast/sc_serv

# firewall first: SSH, the listener/v2 port, and the v1 port only if a v1 encoder needs it
sudo ufw allow OpenSSH
sudo ufw allow 8000/tcp
# only if a SHOUTcast v1 encoder will connect:
# sudo ufw allow 8001/tcp
sudo ufw enable

If the archive unpacks into a subfolder, move its contents up so sc_serv sits directly in /opt/shoutcast. The chmod matters: without it the shell answers Permission denied when you start the binary. Create the log and ban-list directories first: Shoutcast's documentation says the server will not create them for you. ufw applies the same rules to IPv6 when IPV6=yes is set in /etc/default/ufw; check it, because sc_serv listens on every address by default.

The sc_serv.conf lines that decide behaviour

; /opt/shoutcast/sc_serv.conf  (owner shoutcast, mode 600)
portbase=8000
maxuser=1000
password=CHANGE_ME_SOURCE_PASSWORD
adminpassword=CHANGE_ME_DIFFERENT_ADMIN_PASSWORD
publicserver=never

logfile=/opt/shoutcast/logs/sc_serv.log
w3clog=/opt/shoutcast/logs/sc_w3c.log
banfile=/opt/shoutcast/control/sc_serv.ban
ripfile=/opt/shoutcast/control/sc_serv.rip

streamid_1=1
streampath_1=/live
streammaxuser_1=0
streamauthhash_1=

• portbase: the port sources and listeners use. SHOUTcast 1 sources can only connect on portbase + 1, so 8001 stays shut unless such an encoder needs it.
• password is what encoders send; adminpassword opens the admin pages. Make them different: anyone given the source password to go live should not also be able to kick sources or read the logs.
• streamid_1 and streampath_1: stream 1 plays at http://your-host:8000/live, and clients can also reach it at /stream/1/. More streams take _2, _3 and their own path, password and limits.
• streammaxuser_1=0 means the stream inherits maxuser; a value between 0 and maxuser caps that stream alone.
• streamauthhash_1 stays empty until the Directory step below fills it.
• publicserver=never keeps the station out of the Directory whatever the encoder asks for. Change it to default (follow the source) or always when you want the listing.

Lock the file down with sudo chown shoutcast: /opt/shoutcast/sc_serv.conf && sudo chmod 600 /opt/shoutcast/sc_serv.conf: it holds both passwords, and sc_serv itself writes the authhash back into it.

Running it under systemd

The documentation offers a daemon mode (./sc_serv daemon ./sc_serv.conf, which prints its PID) and a foreground mode (./sc_serv sc_serv.conf). Under systemd use the foreground mode and let systemd keep the process; SIGTERM stops it and SIGHUP rotates its logs, both as documented. The unit below is our own, not a file Shoutcast ships.

# /etc/systemd/system/shoutcast.service
[Unit]
Description=Shoutcast Server Software (sc_serv)
After=network-online.target
Wants=network-online.target

[Service]
User=shoutcast
WorkingDirectory=/opt/shoutcast
ExecStart=/opt/shoutcast/sc_serv /opt/shoutcast/sc_serv.conf
LimitNOFILE=8192
Restart=on-failure

[Install]
WantedBy=multi-user.target

Enable it with sudo systemctl daemon-reload && sudo systemctl enable --now shoutcast, then point an encoder at port 8000 with stream ID 1 and the source password.

Admin pages without leaking the password

The public summary is /index.html; the private one is /admin.cgi, user admin, password adminpassword. It shares the listener port and speaks plain HTTP, so the firewall cannot separate it from the audience. Our advice is to reach it through SSH instead: run ssh -N -L 8000:127.0.0.1:8000 you@your-server and, while it runs, browse to http://127.0.0.1:8000/admin.cgi on your own machine.

The docs allow appending &pass= and the admin password to an admin URL. That puts the password in browser history, in proxy logs and in sc_serv's own request log. Use the login prompt.

Directory listing: authhash and publicserver

The authhash is the key that validates your server with the SHOUTcast Directory (the YP2 system). A private station never needs one. For a public one, an archived page of the Shoutcast wiki sets out the order below. It was written for early DNAS 2.0 builds (it cites v2.0.0 Build 29 and was last edited in April 2015), so it predates 2.6.1:

1. Connect a source, so the stream shows on the summary page.
2. Log in to the Administrator Summary and choose Create Authhash under the stream.
3. Fill in the fields the DNAS could not take from the source; on success the key is saved into the empty streamauthhash line.
4. Set publicserver to default or always. According to that wiki page, allow up to 10 minutes for the key to be recognised.

If your build's admin page shows no Create Authhash link, take the key from your SHOUTcast RadioManager account instead and paste it into streamauthhash_1 yourself; RadioManager is also where our hosted stations get theirs. According to that wiki page, updating or removing the authhash later must come from the same external IP that created it, which matters if you move the station to a new server. Directory errors land in the log as YP2 codes: 470 is an invalid authorization hash, 480 means the Directory cannot reach your station (a firewall or NAT in the way), and 479 says streams requiring authorization cannot be listed.

What the free licence tier allows

The Shoutcast Server Software Licence Agreement on shoutcast.com (last updated 30 August 2018) defines two tiers. These rows are its wording, condensed:

If a monthly Premium renewal still goes unpaid after two more charge attempts, the agreement downgrades the account to Freemium within 28 days of the renewal date and reserves the right to stop a station whose stream format (other than MP3 128) Freemium does not support; for an annual subscription it reserves the right to restrict the account to Freemium. It also forbids inflating the audience with muted players or bots. The DNAS documentation lists sslCertificateFile and sslCertificateKeyFile for https streams from version 2.6.1, Linux only.

Hosted DNAS 2.6, or your own machine

Running sc_serv yourself means owning the licence tier, the firewall, the file limits and the authhash. On our SHOUTcast server hosting, a station starts on Icecast 2.5 and one switch in the control panel moves it to a DNAS 2.6 server, on every plan including Free. It keeps DNAS's own admin and status pages; you paste the authhash from your own SHOUTcast RadioManager account into the panel for the Directory listing. The servers are ours, in New York and Bucharest, on AS19624, and bandwidth is not counted on any plan.

The plan sets the limits: 32, 128 or 320 Kbps MP3, and 1,000, 2,500 or 5,000 listeners at once, with Auto DJ on the two paid plans; the radio plans list the rest. An encoder sending above its plan's cap is disconnected, and Directory listeners play a plain-http address while the links you hand out stay https.

If you need sc_serv with your own config, sc_trans, or several stations on one box, a dedicated streaming server is one physical box with root, its port unshared and unmetered, and the steps above apply to it as written. Past one machine's audience, the Icecast relay guide covers splitting listeners across servers.