rcdfrd/webssh repository overview

⁠WebSSH

⁠Introduction

A simple web application to be used as an ssh client to connect to your ssh servers. It is written in Python, base on tornado, paramiko and xterm.js.

⁠Features

• SSH password authentication supported, including empty password.
• SSH public-key authentication supported, including DSA RSA ECDSA Ed25519 keys.
• Encrypted keys supported.
• Two-Factor Authentication (time-based one-time password) supported.
• Fullscreen terminal supported.
• Terminal window resizable.
• Auto detect the ssh server's default encoding.
• Modern browsers including Chrome, Firefox, Safari, Edge, Opera supported.

⁠How it works

+---------+     http     +--------+    ssh    +-----------+
| browser | <==========> | webssh | <=======> | ssh server|
+---------+   websocket  +--------+    ssh    +-----------+

⁠Use Docker

Start up the app

docker run -d -p 8080:8080 rcdfrd/webssh

⁠Deployment

Running behind an Nginx server

# Nginx config example
location / {
    proxy_pass http://127.0.0.1:8888;
    proxy_http_version 1.1;
    proxy_read_timeout 300;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Real-PORT $remote_port;
}

⁠Tips

• For whatever deployment choice you choose, don't forget to enable SSL.
• By default plain http requests from a public network will be either redirected or blocked and being redirected takes precedence over being blocked.
• Try to use reject policy as the missing host key policy along with your verified known_hosts, this will prevent man-in-the-middle attacks. The idea is that it checks the system host keys file("~/.ssh/known_hosts") and the application host keys file("./known_hosts") in order, if the ssh server's hostname is not found or the key is not matched, the connection will be aborted.