Web-based SSH clients basically consist of the following parts:
Client-side terminal emulation
Client-side terminal emulator example: vt100.js
Server-side terminal emulation
Web-based SSH servers that utilize server-side terminal emulation typically keep track of the terminal screen and state in memory and convert it to HTML either when a screen update occurs or when the client expressly requests an update. The advantage of this method is that the state of the terminal remains persistent even if the user connects to their existing session(s) from a different web browser. It also enables the server to act upon terminal output even if the user is disconnected. The disadvantage of this method is that it uses up more CPU and memory on the server.
Server-side terminal emulator example: terminal.py
The main advantages of web-based SSH can be summarized as follows:
- Accessibility: Web-based SSH as described in this article requires no local installation of client software. It is thus possible to access SSH servers through a web browser from anywhere. As communication is based on HTTP or HTTPS it is also possible to access SSH servers from behind a firewall or proxy that restricts Internet access to only ports 80 (HTTP) or 443 (HTTPS).
- Anonymous Access: As SSH access is tunneled through an intermediary web application server it is this server which actually communicates with the SSH server. This means that the SSH server will only be aware of the IP address of the web application server, keeping the actual client's IP address hidden.
- Auditability: Because all communication between the client and the SSH server must pass through the web application server this communication can be logged. This prevents a malicious client from deleting logs of their activities. The situation is exactly the same as with traditional SSH server.
- Resuming Sessions: Some web-based SSH implementations allow the user to resume their SSH sessions after being disconnected. This is not possible with a traditional SSH client.
- Embeddable: Web-based SSH implementations can be embedded into any web page allowing them to be integrated into other web-based applications.
- Unique Features: Many web-based SSH tools have unique features such as the ability to share terminals with other users, can display images within terminals, and other useful capabilities.
The following issues have to be considered and are important when using a web-based SSH client:
- Security: It is important to make sure that HTTPS is used when communicating with the web application server. Otherwise all data being sent would be readable by use of simple packet sniffers which could reveal sensitive information.
- Trust: The data being sent to the web application server is decrypted there. This is necessary in order to forward the issued commands to the actual SSH server. Even though the operators of web-based SSH solutions usually don't log sensitive data the data is theoretically available to them in plain form. It is unlikely that this will cause a security issue when the web application server and the SSH server are run on the same server or are controlled by the same entity.
- Tunneling: Unlike most traditional, application based SSH clients, web-based SSH clients are unable to tunnel ("forward") TCP traffic. For example, running an X session over a web-based SSH session is not possible. However, the lack of ability is caused by implementation issues, and not inherent in some way.
Free and open source examples
- shellinabox operates as a stand-alone service or in conjunction with nginx to provide HTTPS access to a login shell, and is packaged for Debian and RedHat -derived Linux distributions.
- webssh is a similar solution written in Python.
- Bastillion is a self hosted, web-based bastion host with auditing and key management capabilities. Users connect to a centralized server over HTTPS and SSH connections are proxied through a secure WebSocket transport.
- FireSSH is a browser plug-in that works on Firefox ESR and Waterfox.
- The expect function from Gate One's termio.py module can act upon terminal output even if the user is disconnected.
- jcterm claims to be able to handle port forwarding, such as X11 forwarding
- Chromium Secure Shell FAQ
- nassh-relay GitHub repository
- Bastillion - Web-Based SSH Access and Key Management