SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Web-based SSH</title>

</head>

<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">Web-based SSH</span></span>

</h1>

</header>

<p><b>Web-based SSH</b> is the provision of <a href="Secure_Shell" title="Secure Shell">Secure Shell</a> (SSH) access through a <a href="Web_browser" title="Web browser">web browser</a>. SSH is a secure network protocol that is commonly used to remotely control servers, network devices, and other devices. With web-based SSH, users can access and manage these devices using a standard web browser, without the need to install any additional software.

</p><p>Web-based SSH clients are typically implemented using <a href="JavaScript" title="JavaScript">JavaScript</a> and either <a href="Ajax_(programming)" title="Ajax (programming)">Ajax</a> or <a href="WebSocket" title="WebSocket">WebSockets</a>. These clients communicate with the SSH server through a <a href="Proxy_server" title="Proxy server">proxy</a>, which allows them to bypass <a href="Firewall_(computing)" title="Firewall (computing)">firewalls</a> and other network security measures that may block SSH traffic. This makes web-based SSH a convenient and secure way to access remote servers and devices from any location with an internet connection.

</p><p>Web-based SSH is useful for a variety of purposes, including system administration, network management, and remote development. It is often used by IT professionals and developers to remotely access and manage servers, as well as by individuals who need to access their home or office computers from a remote location.

</p>

<div class="mw-heading mw-heading2"><h2 id="Technology">Technology</h2></div>

<p>Web-based SSH clients are applications that allow users to access <a href="Secure_Shell" title="Secure Shell">Secure Shell</a> (SSH) servers through a <a href="Web_browser" title="Web browser">web browser</a>. They consist of two main parts: a client-side component, which is typically implemented using <a href="JavaScript" title="JavaScript">JavaScript</a> and <a href="Dynamic_HTML" title="Dynamic HTML">dynamic HTML</a>, and a server-side or web application component, which is typically implemented on an <a href="Application_server" title="Application server">application server</a>.

</p><p>The client-side component captures keystrokes, transmits messages to and from the server, and displays the results in the user's web browser. The server-side component processes incoming requests and forwards keyboard events to a secure shell client that communicates with the connected SSH server. Terminal output is either passed to the client, where it is converted into HTML using JavaScript, or it is translated into HTML by the server before it is transmitted to the client.

</p>

<div class="mw-heading mw-heading3"><h3 id="Terminal_emulation">Terminal emulation</h3></div>

<p>Web-based SSH servers can use either client-side or server-side terminal emulation.

</p>

<div class="mw-heading mw-heading4"><h4 id="Client-side_terminal_emulation">Client-side terminal emulation</h4></div>

<p>Client-side terminal emulation transmits the raw terminal output from the SSH server directly to the client, which has the advantage of offloading the process of translating terminal output into HTML onto the client. However, it can be limited by the capabilities of JavaScript and can use a significant amount of the client's CPU and memory.

</p><p>An example of a client-side terminal emulator is vt100.js.<sup id="cite_ref-1" class="reference"><a href="#cite_note-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading4"><h4 id="Server-side_terminal_emulation">Server-side terminal emulation</h4></div>

<p>Server-side terminal emulation keeps track of the terminal screen and state in memory and converts it to HTML when a screen update occurs or when the client requests an update. This method has the advantage of keeping the state of the terminal persistent even if the user connects to their existing session from a different web browser, but it can use more CPU and memory on the server.

</p><p>An example of a server-side terminal emulator is terminal.py.<sup id="cite_ref-2" class="reference"><a href="#cite_note-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="Advantages">Advantages</h2></div>

<p>The main advantages of web-based <a href="Secure_Shell" title="Secure Shell">SSH</a> can be summarized as follows:

</p>

<ul><li><i>Accessibility</i>: Web-based SSH as described in this article requires no local installation of client software. It is thus possible to access SSH servers through a web browser from anywhere. As communication is based on <a href="HTTP" title="HTTP">HTTP</a> or <a href="HTTPS" title="HTTPS">HTTPS</a> it is also possible to access SSH servers from behind a <a href="Firewall_(computing)" title="Firewall (computing)">firewall</a> or <a href="Proxy_server" title="Proxy server">proxy</a> that restricts Internet access to only ports 80 (<a href="HTTP" title="HTTP">HTTP</a>) or 443 (<a href="HTTPS" title="HTTPS">HTTPS</a>).</li>

<li><i>Anonymous Access</i>: As SSH access is tunneled through an intermediary <a href="Application_server" title="Application server">web application server</a> it is this server which actually communicates with the SSH server. This means that the SSH server will only be aware of the <a href="IP_address" title="IP address">IP address</a> of the web application server, keeping the actual client's IP address hidden.</li>

<li><i>Auditability</i>: Because all communication between the client and the SSH server must pass through the <a href="Application_server" title="Application server">web application server</a> this communication can be logged. This prevents a malicious client from deleting logs of their activities. The situation is exactly the same as with traditional SSH server.</li>

<li><i>Resuming Sessions</i>: Some web-based SSH implementations allow the user to resume their SSH sessions after being disconnected. This is not possible with a traditional SSH client.</li>

<li><i>Embeddable</i>: Web-based SSH implementations can be embedded into any web page allowing them to be integrated into other web-based applications.</li>

<li><i>Unique Features</i>: Many web-based SSH tools have unique features such as the ability to share terminals with other users, can display images within terminals, and other useful capabilities.</li></ul>

<div class="mw-heading mw-heading2"><h2 id="Important_issues">Important issues</h2></div>

<p>The following issues have to be considered and are important when using a web-based SSH client:

</p>

<ul><li><i>Security</i>: It is important to make sure that <a href="HTTPS" title="HTTPS">HTTPS</a> is used when communicating with the <a href="Application_Server" class="mw-redirect" title="Application Server">web application server</a>. Otherwise all data being sent would be readable by use of simple <a href="Packet_sniffer" class="mw-redirect" title="Packet sniffer">packet sniffers</a> which could reveal sensitive information.</li>

<li><i>Trust</i>: The data being sent to the web application server is decrypted there. This is necessary in order to forward the issued commands to the actual <a href="Secure_Shell" title="Secure Shell">SSH</a> server. Even though the operators of web-based SSH solutions usually don't log sensitive data the data is theoretically available to them in plain form. It is unlikely that this will cause a security issue when the <a href="Application_server" title="Application server">web application server</a> and the SSH server are run on the same server or are controlled by the same entity.</li>

<li><i>Tunneling</i>: Unlike most traditional, application based SSH clients, web-based SSH clients are unable to tunnel ("forward") <a href="Transmission_Control_Protocol" title="Transmission Control Protocol">TCP</a> traffic. For example, running an <a href="X_Window_System" title="X Window System">X</a> session over a web-based SSH session is not possible. However, the lack of ability is caused by implementation issues, and not inherent in some way.<sup id="cite_ref-jcterm_3-0" class="reference"><a href="#cite_note-jcterm-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup></li></ul>

<div class="mw-heading mw-heading2"><h2 id="Free_and_open_source_examples">Free and open source examples</h2></div>

<ul><li>Google's <i>Secure Shell extension for Chrome and Chromium</i><sup id="cite_ref-4" class="reference"><a href="#cite_note-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup> pairs the JavaScript hterm terminal emulator with <a href="OpenSSH" title="OpenSSH">OpenSSH</a> client code running on <a href="Native_Client" class="mw-redirect" title="Native Client">Native Client</a>.<sup id="cite_ref-Chromium_Secure_Shell_FAQ_5-0" class="reference"><a href="#cite_note-Chromium_Secure_Shell_FAQ-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup> The Secure Shell extension works with non-Google HTTP-to-SSH proxies via proxy hooks, and third-party application <i>nassh-relay</i><sup id="cite_ref-nassh-relay_6-0" class="reference"><a href="#cite_note-nassh-relay-6"><span class="cite-bracket">[</span>6<span class="cite-bracket">]</span></a></sup> can use those hooks to enable the Secure Shell extension to establish an SSH connection over <a href="XMLHttpRequest" title="XMLHttpRequest">XMLHttpRequest</a> or <a href="WebSocket" title="WebSocket">WebSocket</a> transport.</li>

<li><i>shellinabox</i><sup id="cite_ref-7" class="reference"><a href="#cite_note-7"><span class="cite-bracket">[</span>7<span class="cite-bracket">]</span></a></sup> operates as a stand-alone service or in conjunction with <a href="Nginx" title="Nginx">nginx</a> to provide <a href="HTTPS" title="HTTPS">HTTPS</a> access to a login shell, and is packaged for <a href="Debian" title="Debian">Debian</a> and <a href="RedHat" class="mw-redirect" title="RedHat">RedHat</a> -derived <a href="Linux" title="Linux">Linux</a> distributions.</li>

<li><i>webssh</i><sup id="cite_ref-8" class="reference"><a href="#cite_note-8"><span class="cite-bracket">[</span>8<span class="cite-bracket">]</span></a></sup> is a similar solution written in Python.</li>

<li><i>Bastillion</i><sup id="cite_ref-bastillion_9-0" class="reference"><a href="#cite_note-bastillion-9"><span class="cite-bracket">[</span>9<span class="cite-bracket">]</span></a></sup> is a self hosted, web-based bastion host with auditing and key management capabilities. Users connect to a centralized server over <a href="HTTPS" title="HTTPS">HTTPS</a> and SSH connections are proxied through a secure <a href="WebSocket" title="WebSocket">WebSocket</a> transport.</li>

<li><i>FireSSH</i> is a browser plug-in that works on Firefox ESR and Waterfox.</li></ul>

<ul><li><a href="Web_shell" title="Web shell">Web shell</a></li></ul>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://code.google.com/p/shellinabox/source/browse/demo/vt100.js">"Google Code Archive - Long-term storage for Google Code Project Hosting"</a>.</cite></span>

</li>

<li id="cite_note-2"><span class="mw-cite-backlink"><b><a href="#cite_ref-2">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://liftoff.github.io/GateOne/Developer/terminal.html">"Terminal.py - A Pure Python Terminal Emulator — Gate One 1.2.0 documentation"</a>.</cite></span>

</li>

<li id="cite_note-jcterm-3"><span class="mw-cite-backlink"><b><a href="#cite_ref-jcterm_3-0">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="http://www.jcraft.com/jcterm/">jcterm</a> claims to be able to handle port forwarding, such as X11 forwarding</span>

</li>

<li id="cite_note-4"><span class="mw-cite-backlink"><b><a href="#cite_ref-4">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://chrome.google.com/webstore/detail/iodihamcpbpeioajjeobimgagajmlibd">"Secure Shell App"</a>.</cite></span>

</li>

<li id="cite_note-Chromium_Secure_Shell_FAQ-5"><span class="mw-cite-backlink"><b><a href="#cite_ref-Chromium_Secure_Shell_FAQ_5-0">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="https://chromium.googlesource.com/apps/libapps/+/master/nassh/doc/FAQ.md">Chromium Secure Shell FAQ</a></span>

</li>

<li id="cite_note-nassh-relay-6"><span class="mw-cite-backlink"><b><a href="#cite_ref-nassh-relay_6-0">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="https://github.com/zyclonite/nassh-relay">nassh-relay GitHub repository</a></span>

</li>

<li id="cite_note-7"><span class="mw-cite-backlink"><b><a href="#cite_ref-7">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://github.com/shellinabox/shellinabox">"Shellinabox"</a>. <i><a href="GitHub" title="GitHub">GitHub</a></i>. 28 October 2021.</cite></span>

</li>

<li id="cite_note-8"><span class="mw-cite-backlink"><b><a href="#cite_ref-8">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://pypi.org/project/webssh/">"Webssh: Web based SSH client"</a>.</cite></span>

</li>

<li id="cite_note-bastillion-9"><span class="mw-cite-backlink"><b><a href="#cite_ref-bastillion_9-0">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="https://www.bastillion.io">Bastillion - Web-Based SSH Access and Key Management</a></span>

</li>

</ol></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2024-12-28" href="https://en.wikipedia.org/wiki/?title=Web-based_SSH&oldid=1265737984">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>