SSH through browser? reddit / selfhosted ---------------------------------------------------------------------- OldRice3456 · 2023-10-01 20:45 Just to avoid advice I'm already aware of: I don't want to use a VPN, nor a cloudflare tunnel. I want to self host, ideally docker compatible, piece of software which would utilize ssh port 22 on the local network to access devices on that LAN, and then forward the information through a reverse proxy and securely through https, into my browser window, where I can interact with it from anywhere. I know guacamole, but it seems a bit cluttered with functionality I don't need - RDP and VNC. ---------------------------------------------------------------------- 399ddf95 · 2023-10-01 21:01 https://github.com/stuicey/SSHy might be of interest ---------------------------------------------------------------------- OldRice3456 · 2023-10-01 21:04 Looks pretty nice, though I'd really appreciate being able to create connection profiles, filling the IP, username, and password, and then connecting just by selecting that profile. Guacamole does that too. ---------------------------------------------------------------------- Defiant-Ad-5513 · 2023-10-01 21:14 Maybe https://github.com/nirui/sshwifty is what you are looking for you can set the password in the url and also have an adress book ---------------------------------------------------------------------- bombero_kmn · 2023-10-01 21:32 I've used https://github.com/butlerx/wetty for this. I don't know if it has all the features you're looking for, I just have it set up simple. ---------------------------------------------------------------------- Pabsilon · 2023-10-01 21:46 You can set up a cloudflare tunnel. It allows access through web server AND proper ash installing cloudflared, all without exposing port 22 over the internet. And you can event set up oAuth to go with it. ---------------------------------------------------------------------- thekrautboy · 2023-10-01 21:47 Why not simply search this sub? The answers to this question are always the same. ---------------------------------------------------------------------- nik_h_75 · 2023-10-01 22:41 Same here. Behind nginx on custom port. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-01 23:13 I used to use sstunnel over ssh. So basically I’d run ssh just for the link, then run sstunnel which set up a SOCKS proxy. This was 10 years ago. ---------------------------------------------------------------------- bobbarker4444 · 2023-10-01 23:40 Might not fit your requirements exactly but I use Cloudflare for this to enable ssh in to my proxmox server. Gives you a really slick SSH client in the browser and is very secure ---------------------------------------------------------------------- NikStalwart · 2023-10-02 01:16 Theres a [tmux plugin](https://github.com/bjesus/muxile) you may be interested in. You can also run [code-server](https://github.com/coder/code-server) and use VS Code's terminal for SSH. Github is littered with loads of these web ssh projects; most are so tiny that I have a hard time trusting their security all that much. I may be wrong, but I am somewhat leery of allowing web access to my servers — be it SSH or web servers. I only trust ssh directly or RDP/VNC over VPN. Whatever you do, you best set up some serious authentication. At a bare minimum, either TLS client key or OIDC to a reliable IdP. Or both. ---------------------------------------------------------------------- madroots2 · 2023-10-02 01:32 What service from cloudflare are you talking about please? Thanks ---------------------------------------------------------------------- thekrautboy · 2023-10-02 02:01 Look at sshwifty then, it supports presets. Also sshy hasnt been updated in a very long time. ---------------------------------------------------------------------- thekrautboy · 2023-10-02 02:36 > and is as secure as you're going to get Really? As secure as its going to get? By installing a tunnel to a large corporation and trusting them with it? With SSH access? You know this is /r/selfhosted here, right? ---------------------------------------------------------------------- thekrautboy · 2023-10-02 02:38 "Hey Google, search cloudflare ssh" -> https://developers.cloudflare.com/cloudflare- one/connections/connect-networks/use-cases/ssh/ ---------------------------------------------------------------------- thekrautboy · 2023-10-02 02:46 > all without exposing port 22 over the internet all without being selfhosted ---------------------------------------------------------------------- bobbarker4444 · 2023-10-02 03:36 It's under Access in the Zero Trust section. Step 1 is setting up a tunnel (via cloudflared) with a public hostname that points at your SSH server. eg, ssh.yourdomain.com Step 2 is creating an "Application". Give the application the exact same subdomain etc as what you entered for the tunnel. Then under "Settings" as you set up the Application, choose SSH in the Browser Rendering at the bottom. ---------------------------------------------------------------------- bobbarker4444 · 2023-10-02 03:48 >By trusting a large corporation? With SSH access? No. That's the point. You *don't* trust Cloudflare with your ssh access. They don't have any way to access your ssh server. They are just an additional layer for someone to go through before even seeing your server. >You know this is r/selfhosted here, right? Yes. And security around remote access is extremely critical. Probably the *most* critical thing for any server. There are a ton of great self-hosted tools out there for providing remote access and I would still try to wrap each one in as much security as I can if they're going to be public facing. >but calling it "as secure as it gets" is a stretch What do you propose is better without any kind of VPN? Obviously the best solution is a VPN avoiding anything public facing in the first place, but if the requirements are "Public facing SSH through a browser" I haven't seen anything that can beat Cloudflare. ---------------------------------------------------------------------- IllustratorVarious · 2023-10-02 04:03 Sample `conf.json` that I currently use ```json { "HostName": "localhost", # change it to fit your use case "SharedKey": "", "DialTimeout": 10, "Servers": [ { "ListenInterface": "0.0.0.0", "ListenPort": 8182, "InitialTimeout": 3, "ReadTimeout": 60, "WriteTimeout": 60, "HeartbeatTimeout": 20, "ReadDelay": 0, "WriteDelay": 0, "TLSCertificateFile": "", "TLSCertificateKeyFile": "", "ServerMessage": "" } ], "Presets": [ { "Title": "Home Lab", "Type": "SSH", "Host": "localhost", # change it to fit your use case "Meta": { "User": "environment://SSH_USERNAME", "Encoding": "utf-8", "Password": "environment://SSH_PASSWORD", "Authentication": "Password", # change it to fit your use case "Fingerprint": "environment://SSH_FINGERPRINT" } } ], "OnlyAllowPresetRemotes": true }``` `compose.yml` ```yaml version: '3' services: app: image: niruix/sshwifty:latest network_mode: host # change it to fit your use case container_name: sshwifty restart: always volumes: - ./conf.json:/home/sshwifty/conf.json environment: - SSHWIFTY_CONFIG=/home/sshwifty/conf.json env_file: - $HOME/.ssh_secret user: 1000:1000 ``` and then set SSH_USERNAME, SSH_PASSWORD, SSH_FINGERPRINT environment variables inside `$HOME/.ssh_secret` on host machine ---------------------------------------------------------------------- OldRice3456 · 2023-10-02 04:44 Exactly 🙏 ---------------------------------------------------------------------- poultryinmotion1 · 2023-10-02 04:45 What do you have against hosting your own wireguard VPN? ---------------------------------------------------------------------- ulysse132 · 2023-10-02 04:51 You can also deploy portainer (for the webgui) and a openssh server container (for needed tools) and then use the portainer web terminal of openssh container and connect wherever you want. ---------------------------------------------------------------------- OldRice3456 · 2023-10-02 04:54 Thanks, this is really useful info, tho I noticed that all of these solutions either use host network mode, or, they only expose one port for the web GUI like 8182 - doesn't port 22 also need to be exposed? ---------------------------------------------------------------------- thekrautboy · 2023-10-02 04:56 Incoming and outgoing are different things. Port 22 is not required because you are not connecting through SSH (22) to the container. You are connecting with your browser to it. ---------------------------------------------------------------------- OldRice3456 · 2023-10-02 04:57 Right, that's what I assumed, thanks! ---------------------------------------------------------------------- thekrautboy · 2023-10-02 04:58 *yawn* ---------------------------------------------------------------------- bobbarker4444 · 2023-10-02 05:01 ? ---------------------------------------------------------------------- geo38 · 2023-10-02 05:19 > you also can store the connections You can store predefined connections in the sshwifty.conf.json file, right? I don't see that any new connections I make within the web page are stored anywhere once I exit the browser session and start another? Am I doing something wrong? Thanks for any help. ---------------------------------------------------------------------- madroots2 · 2023-10-02 05:21 Thank you! ---------------------------------------------------------------------- Defiant-Ad-5513 · 2023-10-02 05:21 In the web UI you can define the connection ---------------------------------------------------------------------- iC0nk3r · 2023-10-02 05:58 Teleport does this. ---------------------------------------------------------------------- austozi · 2023-10-02 06:01 I use this and it works well: https://github.com/huashengdun/webssh ---------------------------------------------------------------------- sza_rak · 2023-10-02 06:25 You got some nice responses, but don't throw away guacamole so easily. I have it running 24/7 and honestly forgot it's there. It consumes <100MB in my case, plus postgresql which consumes so little ram I had to double check if I'm seeing correctly. It has also this fun feature of "Kubernetes" connection, which hooks you into a container. Weird but cool. ---------------------------------------------------------------------- valdecircarvalho · 2023-10-02 06:35 Guacamole ---------------------------------------------------------------------- ragnarkarlsson · 2023-10-02 07:36 I agree. Yes, Guacamole has a load of other supported connection types. However if you just want to set up a number of SSH profiles, once created you won't even notice that those other options exist. It's lightweight and does meet your requirements. Sometimes using a tool which has more options rather than something dedicated to a particular use case isn't a bad thing. Plus when you suddenly find yourself needing VNC or RDP it's there 😃 ---------------------------------------------------------------------- Readdeo · 2023-10-02 08:02 Not browser client, but try Tabby ---------------------------------------------------------------------- therauch1 · 2023-10-02 08:32 Maybe it's a bit too much already but the cockpit project has this functionality and is well supported. It is a whole webinterface to manage Linux servers but also gives you the ability to open an ssh console of the local and remote servers. [https://cockpit-project.org/](https://cockpit-project.org/) ---------------------------------------------------------------------- pielman · 2023-10-02 10:30 At least use authelia/authentic for 2factor authentication for your SSL ssh access. ---------------------------------------------------------------------- daYMAN007 · 2023-10-02 11:19 >Just to avoid advice I'm already aware of: I don't want to use a VPN, nor a cloudflare tunnel. Seriously it's so annoying what this sub has become, no matter the question disclaimers like this are necessary nowadays... ---------------------------------------------------------------------- IllCollection · 2023-10-02 11:27 This is the way ---------------------------------------------------------------------- Educational-Craft545 · 2023-10-02 11:28 I've always used ttyd and gotty ---------------------------------------------------------------------- billiarddaddy · 2023-10-02 11:53 I've been using guacamole for this. Works well. ---------------------------------------------------------------------- nanopresso11 · 2023-10-02 12:00 I use the stack of Firefox and shellinabox. \- Shellinabox is install locally and accessible via localhost \- Firefox is a docker container and accessible via proxy... I used Traefik and added a oauth middleware as a security layer when accessing firefox, from Firefox access shellinabox. At least with this I have full control of the stack. ---------------------------------------------------------------------- f3bf3b · 2023-10-02 12:10 We use [https://jumpserver.org/](https://jumpserver.org/) , [https://github.com/jumpserver](https://github.com/jumpserver) here on our office to access all our servers (local and cloud server) from browser. They have quite good & user friendly GUI, they also save logs and session history which is very important for us. Yes I know they are from China, and most of their documentation are also in chinese. But they tick all the boxes we need, it's open source, self hosted, and we don't find anything weird with their program yet. ---------------------------------------------------------------------- Reverent · 2023-10-02 12:33 Noting that exposing any admin interface directly to the web is typically a terrible idea. ---------------------------------------------------------------------- HardChalice · 2023-10-02 13:22 KasmVNC is another option. Better performance than guacamole from what ive seen. ---------------------------------------------------------------------- servergeek82 · 2023-10-02 13:23 Kasm - I've used as a on the fly jump box into my server. Spin up access locally and spin down when done. Cockpit - I forward the port while away and close port when done Webmin - same as above Straight ssh - close port when done Forward iLO port and access backend of my HP server and ssh console. - close port when done. As already mentioned accessing backend / console / admin interfaces publicly is not a good idea. I always have scans from countries looking for open ports and standard usernames. ---------------------------------------------------------------------- bytepursuits · 2023-10-02 13:41 https://shellngn.com/ - it's a paid product (not mine). ---------------------------------------------------------------------- therauch1 · 2023-10-02 13:58 Yes of course. I don‘t support this whole idea but OP made clear he’s aware of the situation. I just mentioned the tool as it does the job, is supported and has some security built into it. ---------------------------------------------------------------------- jdblaich · 2023-10-02 15:21 A console in the browser? Do you want just the browser acting like it has a different IP? Or something else entirely? ---------------------------------------------------------------------- KrazyKirby99999 · 2023-10-02 16:22 Would basicauth be sufficient? ---------------------------------------------------------------------- DellR610 · 2023-10-02 16:55 SSH natively supports such a thing. https://youtu.be/_CPxlzznv0U?si=TCxbH60egmcaeOdy ---------------------------------------------------------------------- AnApexBread · 2023-10-02 18:31 >I know guacamole, but it seems a bit cluttered with functionality I don't need - RDP and VNC So take it out. Guacamole can be configured pretty much however you want. ---------------------------------------------------------------------- BiatuAutMiahn · 2023-10-02 20:27 ttyd ---------------------------------------------------------------------- BiatuAutMiahn · 2023-10-02 20:28 specifically I ran ttyd pointing at login. then used apache reverse proxy ---------------------------------------------------------------------- Reverent · 2023-10-02 21:14 Without a rate limiter and https, no. ---------------------------------------------------------------------- coderkid723 · 2023-10-02 23:56 Use CodeServer ---------------------------------------------------------------------- netvip3r · 2023-10-03 03:06 If I understand right, u want ssh tunneling ```ssh -R 8080:localhost:80 ``` This would allow u to point your browser to ```localhost:80``` to "see" the Web server on ```remote.host:8080```. You have to turn on tunneling in sshd.conf , as it usually defaults to off ---------------------------------------------------------------------- NinjaFragrant7710 · 2023-12-22 20:55 Can you elaborate on your setup please?