7 ms·

Show HN: Sshx, a web-based collaborative terminal

242 points by ekzhang 3y ago

nolist_policy 3y ago
You can share the same terminal session to multiple ssh connections with gnu screen btw.
- mike503 3y ago
  screen -x However the unique prop here is that it's web-based.
  - bitwize 3y ago
    If it isn't web-based, or you can't 'npm i' it, it may as well not exist.
    - wiseowise 3y ago
      This, but unironically.
    - quickthrower2 3y ago
      npx it these days
- vulcan01 3y ago
  Or tmux. I guess neither are as intuitive as clickable buttons though.
  - ekzhang 3y ago
    Yep, it was a big inspiration for this. tmux won’t sync window sizes properly between viewers though
    - somat 3y ago
      multiple connections to the same tmux session right? I never had a problem with it, tmux picks the largest space that can fit all terminals. should it be doing something different?
- deleted 3y ago
  [deleted]
- gooseyard 3y ago
  I'll plug https://tmate.io/ https://tmate.io/ as well, its incredibly handy
  - ekzhang 3y ago
    tmate is an incredible piece of software! The terminal multiplexing is surprisingly similar to the problem of collaboratively sharing terminals, and forking tmux is a really elegant way to handle that. I took a lot of inspiration from other terminal software out there
    - minerva23 3y ago
      Have you considered adding a section to the readme comparing Sshx to these well-known alternatives?
      - ekzhang 3y ago
        I could do it!! It’s on the list (note that sshx is pretty different from all the suggested alternatives though)
  - stavros 3y ago
    Tmate is amazing, highly recommended. It's my favorite way to do pair programming.
teaearlgraycold 3y ago
Web developers live in the web, but we still need to interface with VMs over SSH. Bridging that gap in favor of the developer is genius. The multiplayer aspect, the shell one-liner to bootstrap the whole process, everything about this is great.
- ekzhang 3y ago
  Thanks! Yeah you can use it anywhere with outbound HTTP network access, whether that’s a local VM, cloud instance, laptop, k8s pod, random managed SaaS, serverless function, Raspberry Pi, …
skimdesk 3y ago
Really fun! I have been experimenting with similar idea myself. I was curious on how you handle instantiating the terminal state for new clients. Seems like you're storing a buffer [0] of past output, and replaying that? [0] https://github.com/ekzhang/sshx/blob/91c82d46cde4d1ffa0ae34e2a9a49911e2e53baa/crates/sshx-server/src/session.rs#L26 https://github.com/ekzhang/sshx/blob/91c82d46cde4d1ffa0ae34e...
- ekzhang 3y ago
  Yep, it’s a rolling 2 MiB buffer in RAM. Also do some snapshotting for persistence / server fault-tolerance, and that size is much smaller.
  - mkj 3y ago
    Does that mean it can avoid having to interpret terminal control codes (ie be a full terminal emulator)? That's a clever way.
cjbprime 3y ago
Thanks for writing and sharing this!
throwawaaarrgh 3y ago
[flagged]
- arjvik 3y ago
  Read that as public keys and assumed you were being serious. Was about to say that's exactly what github does - `https://github.com/{username}.keys https://github.com/{username}.keys`
- ekzhang 3y ago
  You need a key to access the terminal, and the key is never sent to the server or over the network, it goes in the browser hash. You could say the same about Jupyter being a web access tool, for instance. sshx only lets you make ephemeral connections and isn’t meant to be a remote access tool All session IDs and encryption keys are cryptographically generated. And sshx refuses to connect except over TLS
  - quickthrower2 3y ago
    Jupyter typically is either run local or run in containers online for example Google Colab.
  - throwawaaarrgh 3y ago
    If you give someone a link they can access your terminal right? Then none of the rest matters. A URL isn't a secret. Hence it's unathenticated remote access. Which is nuts. Every competent network admin in every company should be blocking this right now. What a crazy risk to open up for the sake of laziness.
arjvik 3y ago
I’ve been using GoTTY (https://github.com/yudai/gotty https://github.com/yudai/gotty) to do the same thing, combined with ngrok or Cloudflare tunnels to get a publically accessible URL. To enable multiplayer mode, just need screen/tmux.
- ekzhang 3y ago
  Nice trick! Many people have mentioned that tmux lets you share terminals, though worth noting that it takes a bit of setup, doesn’t render correctly when you have different screen sizes, and requires stitching together a lot of other tools to work over a browser. Personally I think being able to arrange and resize terminals adds a lot to the collaboration feeling, as well as seeing people’s cursors. I encourage you to give it a try! (it takes less than a second to install, and then you just run “sshx”)
throwaway81733 3y ago
I suspect the encryption here is broken due to CTR mode AES with IV reuse. Try printing out the IV in the segment function. It's the same value across sessions. Another thing I see is that AES-CTR is being used alone, so there is no integrity guarantee for the messages. I didn't have time to look into it any more deeply. The user interface and concept look really nice, but I would strongly recommend a cryptographic audit. In general, you shouldn't have to reach for the subtle constructs in a cryptographic library to build product features.
- ekzhang 3y ago
  Hey, this is a serious accusation. I would be very careful about raising false suspicions like this publicly. The application does not reuse IVs. For your second point, I am aware of authenticated encryption and the possibility of bit-level tampering with commands. The point of the encryption is to make sure to preserve confidentiality here. Tampering with commands is not really part of the threat model. The server needs to be trusted in some regard. If the server were compromised and actually modified commands, and it could send arbitrary network messages, then it could just change the HTML payload to the website and show the end user something different. The point of the encryption is only to preserve confidentiality with a properly running server, so CTR mode was chosen. I appreciate your dedication to security, but I would strongly advise you do more research before making comments like this — I take security very seriously as well, and making vague, unfounded accusations without actually reading the code only serves to confuse people.
  - jchook 3y ago
    Maybe you can provide intuition about how the IVs are not predictable? They seem to be formulaic. https://github.com/ekzhang/sshx/blob/91c82d46cde4d1ffa0ae34e2a9a49911e2e53baa/src/lib/encrypt.ts#L55 https://github.com/ekzhang/sshx/blob/91c82d46cde4d1ffa0ae34e...
    - ekzhang 3y ago
      You're exactly right. The IVs are completely predictable, and crucially, that allows us to guarantee that they are not reused. The security of CTR mode of encryption depends on avoiding IV reuse. Once again, I'm very happy to have this discussion at length! I just would prefer a context where people are not confused by misleading information from the start, and the readers are able to spend time thinking about it.
alchemist1e9 3y ago
Extremely cool. Do the terminal emulators support sixel?
deleted 3y ago
[deleted]
jpeeler 3y ago
Very cool! Would love to see the ability to restrict remote parties, both for read-only viewing and from opening additional terminals.
quickthrower2 3y ago
why don’t those risky “curl | sh” commands at least do some checksum or sig verification?
- panki27 3y ago
  I love how it's a self-proclaimed "secure web-based, collaborative terminal" but the installation instructions are the exact opposite. Never blindly execute files without looking at them first!
  - ekzhang 3y ago
    I'm not sure about this criticism — the script is written to be as simple as possible and also has a comment about this if you do inspect it as you suggest. # This is a short script to install the latest version of the sshx binary. # # It's meant to be as simple as possible, so if you're not happy hardcoding a # `curl | sh` pipe in your application, you can just download the binary # directly with the appropriate URL for your architecture. You're also welcome to install it any way you choose! The code is fully open-source, and it has straightforward instructions to build from source.
supriyo-biswas 3y ago
Why does the sshx.io/get URL detect a browser using the Accept-Encoding header and return 404? Generally I don’t have much to say about curl | bash, but going out of your way to hide the script is a bit suspicious.
- d-z-m 3y ago
  I don't think it's anything nefarious. Can't pipe a brotli'd response into bash. My browser wasn't accepting the 'identity' encoding. If you alter your browser to accept 'identity', it will return the script.
  - supriyo-biswas 3y ago
    curl --compressed is very much a thing, and some people may have that set as the default.
    - d-z-m 3y ago
      ha, learn something new everyday. Hadn't run across the --compressed option before.
- deleted 3y ago
  [deleted]
- ekzhang 3y ago
  I'm not sure honestly, if you could raise an issue I'd appreciate it. I didn't go out of my way to do this; it seems to be some default of SvelteKit or the server code that I don't understand?
  - 698969 3y ago
    Seems like something to do with your deployment server config. You may be redirecting all pages to your fallback spa.html. I built the site and served it with `python3 -m http.server --dir build` and it served the script to the browser without an issue.
ciberado 3y ago
Super cool. Our students are using ttdy[0] and tmux for providing shared access to a configured environment, but your solution seems much more flexible :) I'm going to start experimenting with it for our next courses, thanks! [0] https://github.com/tsl0922/ttyd https://github.com/tsl0922/ttyd
- ekzhang 3y ago
  That's amazing! Let me know how it goes or if you need anything.
hiAndrewQuinn 3y ago
This is one of the coolest things I've seen in a while. I'm gonna find a way to try this out TODAY.
apienx 3y ago
This is super useful. Thanks for sharing!
deleted 3y ago
[deleted]
andelink 3y ago
Tried it out. This is a fantastic user experience. Great job!

242 points by ekzhang 3y ago

nolist_policy 3y ago

You can share the same terminal session to multiple ssh connections with gnu screen btw.

mike503 3y ago
screen -x However the unique prop here is that it's web-based.
- bitwize 3y ago
  If it isn't web-based, or you can't 'npm i' it, it may as well not exist.
  - wiseowise 3y ago
    This, but unironically.
  - quickthrower2 3y ago
    npx it these days
vulcan01 3y ago
Or tmux. I guess neither are as intuitive as clickable buttons though.
- ekzhang 3y ago
  Yep, it was a big inspiration for this. tmux won’t sync window sizes properly between viewers though
  - somat 3y ago
    multiple connections to the same tmux session right? I never had a problem with it, tmux picks the largest space that can fit all terminals. should it be doing something different?
deleted 3y ago
[deleted]
gooseyard 3y ago
I'll plug https://tmate.io/ https://tmate.io/ as well, its incredibly handy
- ekzhang 3y ago
  tmate is an incredible piece of software! The terminal multiplexing is surprisingly similar to the problem of collaboratively sharing terminals, and forking tmux is a really elegant way to handle that. I took a lot of inspiration from other terminal software out there
  - minerva23 3y ago
    Have you considered adding a section to the readme comparing Sshx to these well-known alternatives?
    - ekzhang 3y ago
      I could do it!! It’s on the list (note that sshx is pretty different from all the suggested alternatives though)
- stavros 3y ago
  Tmate is amazing, highly recommended. It's my favorite way to do pair programming.

teaearlgraycold 3y ago

Web developers live in the web, but we still need to interface with VMs over SSH. Bridging that gap in favor of the developer is genius. The multiplayer aspect, the shell one-liner to bootstrap the whole process, everything about this is great.

ekzhang 3y ago
Thanks! Yeah you can use it anywhere with outbound HTTP network access, whether that’s a local VM, cloud instance, laptop, k8s pod, random managed SaaS, serverless function, Raspberry Pi, …

skimdesk 3y ago

Really fun! I have been experimenting with similar idea myself. I was curious on how you handle instantiating the terminal state for new clients. Seems like you're storing a buffer [0] of past output, and replaying that? [0] https://github.com/ekzhang/sshx/blob/91c82d46cde4d1ffa0ae34e2a9a49911e2e53baa/crates/sshx-server/src/session.rs#L26 https://github.com/ekzhang/sshx/blob/91c82d46cde4d1ffa0ae34e...

ekzhang 3y ago
Yep, it’s a rolling 2 MiB buffer in RAM. Also do some snapshotting for persistence / server fault-tolerance, and that size is much smaller.
- mkj 3y ago
  Does that mean it can avoid having to interpret terminal control codes (ie be a full terminal emulator)? That's a clever way.

cjbprime 3y ago

Thanks for writing and sharing this!

throwawaaarrgh 3y ago

[flagged]

arjvik 3y ago
Read that as public keys and assumed you were being serious. Was about to say that's exactly what github does - `https://github.com/{username}.keys https://github.com/{username}.keys`
ekzhang 3y ago
You need a key to access the terminal, and the key is never sent to the server or over the network, it goes in the browser hash. You could say the same about Jupyter being a web access tool, for instance. sshx only lets you make ephemeral connections and isn’t meant to be a remote access tool All session IDs and encryption keys are cryptographically generated. And sshx refuses to connect except over TLS
- quickthrower2 3y ago
  Jupyter typically is either run local or run in containers online for example Google Colab.
- throwawaaarrgh 3y ago
  If you give someone a link they can access your terminal right? Then none of the rest matters. A URL isn't a secret. Hence it's unathenticated remote access. Which is nuts. Every competent network admin in every company should be blocking this right now. What a crazy risk to open up for the sake of laziness.

arjvik 3y ago

I’ve been using GoTTY (https://github.com/yudai/gotty https://github.com/yudai/gotty) to do the same thing, combined with ngrok or Cloudflare tunnels to get a publically accessible URL. To enable multiplayer mode, just need screen/tmux.

ekzhang 3y ago
Nice trick! Many people have mentioned that tmux lets you share terminals, though worth noting that it takes a bit of setup, doesn’t render correctly when you have different screen sizes, and requires stitching together a lot of other tools to work over a browser. Personally I think being able to arrange and resize terminals adds a lot to the collaboration feeling, as well as seeing people’s cursors. I encourage you to give it a try! (it takes less than a second to install, and then you just run “sshx”)

throwaway81733 3y ago

I suspect the encryption here is broken due to CTR mode AES with IV reuse. Try printing out the IV in the segment function. It's the same value across sessions. Another thing I see is that AES-CTR is being used alone, so there is no integrity guarantee for the messages. I didn't have time to look into it any more deeply. The user interface and concept look really nice, but I would strongly recommend a cryptographic audit. In general, you shouldn't have to reach for the subtle constructs in a cryptographic library to build product features.

ekzhang 3y ago
Hey, this is a serious accusation. I would be very careful about raising false suspicions like this publicly. The application does not reuse IVs. For your second point, I am aware of authenticated encryption and the possibility of bit-level tampering with commands. The point of the encryption is to make sure to preserve confidentiality here. Tampering with commands is not really part of the threat model. The server needs to be trusted in some regard. If the server were compromised and actually modified commands, and it could send arbitrary network messages, then it could just change the HTML payload to the website and show the end user something different. The point of the encryption is only to preserve confidentiality with a properly running server, so CTR mode was chosen. I appreciate your dedication to security, but I would strongly advise you do more research before making comments like this — I take security very seriously as well, and making vague, unfounded accusations without actually reading the code only serves to confuse people.
- jchook 3y ago
  Maybe you can provide intuition about how the IVs are not predictable? They seem to be formulaic. https://github.com/ekzhang/sshx/blob/91c82d46cde4d1ffa0ae34e2a9a49911e2e53baa/src/lib/encrypt.ts#L55 https://github.com/ekzhang/sshx/blob/91c82d46cde4d1ffa0ae34e...
  - ekzhang 3y ago
    You're exactly right. The IVs are completely predictable, and crucially, that allows us to guarantee that they are not reused. The security of CTR mode of encryption depends on avoiding IV reuse. Once again, I'm very happy to have this discussion at length! I just would prefer a context where people are not confused by misleading information from the start, and the readers are able to spend time thinking about it.

alchemist1e9 3y ago

Extremely cool. Do the terminal emulators support sixel?

deleted 3y ago

[deleted]

jpeeler 3y ago

Very cool! Would love to see the ability to restrict remote parties, both for read-only viewing and from opening additional terminals.

quickthrower2 3y ago

why don’t those risky “curl | sh” commands at least do some checksum or sig verification?

panki27 3y ago
I love how it's a self-proclaimed "secure web-based, collaborative terminal" but the installation instructions are the exact opposite. Never blindly execute files without looking at them first!
- ekzhang 3y ago
  I'm not sure about this criticism — the script is written to be as simple as possible and also has a comment about this if you do inspect it as you suggest. # This is a short script to install the latest version of the sshx binary. # # It's meant to be as simple as possible, so if you're not happy hardcoding a # `curl | sh` pipe in your application, you can just download the binary # directly with the appropriate URL for your architecture. You're also welcome to install it any way you choose! The code is fully open-source, and it has straightforward instructions to build from source.

supriyo-biswas 3y ago

Why does the sshx.io/get URL detect a browser using the Accept-Encoding header and return 404? Generally I don’t have much to say about curl | bash, but going out of your way to hide the script is a bit suspicious.

d-z-m 3y ago
I don't think it's anything nefarious. Can't pipe a brotli'd response into bash. My browser wasn't accepting the 'identity' encoding. If you alter your browser to accept 'identity', it will return the script.
- supriyo-biswas 3y ago
  curl --compressed is very much a thing, and some people may have that set as the default.
  - d-z-m 3y ago
    ha, learn something new everyday. Hadn't run across the --compressed option before.
deleted 3y ago
[deleted]
ekzhang 3y ago
I'm not sure honestly, if you could raise an issue I'd appreciate it. I didn't go out of my way to do this; it seems to be some default of SvelteKit or the server code that I don't understand?
- 698969 3y ago
  Seems like something to do with your deployment server config. You may be redirecting all pages to your fallback spa.html. I built the site and served it with `python3 -m http.server --dir build` and it served the script to the browser without an issue.

ciberado 3y ago

Super cool. Our students are using ttdy[0] and tmux for providing shared access to a configured environment, but your solution seems much more flexible :) I'm going to start experimenting with it for our next courses, thanks! [0] https://github.com/tsl0922/ttyd https://github.com/tsl0922/ttyd

ekzhang 3y ago
That's amazing! Let me know how it goes or if you need anything.

hiAndrewQuinn 3y ago

This is one of the coolest things I've seen in a while. I'm gonna find a way to try this out TODAY.

apienx 3y ago

This is super useful. Thanks for sharing!

deleted 3y ago

[deleted]

andelink 3y ago

Tried it out. This is a fantastic user experience. Great job!