Community Hass.io Add-ons: SSH & Web Terminal

This add-on allows you to log in to your Hass.io Home Assistant instance using SSH or by using the Web Terminal.

About

This add-on allows you to log in to your Hass.io Home Assistant instance using SSH or a Web Terminal, giving you to access your Hass.io folders and also includes a command-line tool to do things like restart, update, and check your instance.

This is an enhanced version of the provided SSH add-on by Home Assistant and focusses on security, usability, flexibility and also provides access using a web interface.

Features

This add-on, of course, provides an SSH server, based on OpenSSH and a web-based Terminal (which can be included in your Home Assistant frontend) as well. Additionally, it comes out of the box with the following:

Access your command line right from the Home Assistant frontend!
A secure default configuration of SSH:
- Only allows login by the configured user, even if more users are created.
- Only uses known secure ciphers and algorithms.
- Limits login attempts to hold of brute-force attacks better.
- Many more security tweaks, this addon passes all ssh-audit checks without warnings!
Comes with an SSH compatibility mode option to allow older clients to connect.
SFTP support is disabled by default but is user configurable.
Compatible if Hass.io was installed via the generic Linux installer.
Username is configurable, so root is no longer mandatory.
Persists custom SSH client settings & keys between add-on restarts
Log levels for allowing you to triage issues easier.
Hardware access to your audio and uart/serial devices.
Runs with more privileges, allowing you to debug and test more situations.
Has access to the dbus of the host system.
Runs on host level network, allowing you to open ports or run little daemons.
Have custom Alpine packages installed on start. This allows you to install your favorite tools, which will be available every single time you log in.
Execute custom commands on add-on start so that you can customize the shell to your likings.
ZSH as its default shell. Easier to use for the beginner, more advanced for the more experienced user. It even comes preloaded with "Oh My ZSH", with some plugins enabled as well.
Contains a sensible set of tools right out of the box: curl, Wget, RSync, GIT, Nmap, Mosquitto client, MariaDB/MySQL client, Awake (“wake on LAN”), Nano, Vim, tmux, and a bunch commonly used networking tools.

Installation

The installation of this add-on is pretty straightforward and not different in comparison to installing any other Hass.io add-on.

If you installed the "SSH server" add-on from the built-in add-on, then remove that one first.
Add our Hass.io add-ons repository to your Hass.io instance.
Install the "SSH & Web Terminal" add-on.
Configure the username and password/authorized_keys options.
Activate ssl on the Web Terminal if you use it.
Start the "SSH & Web Terminal" add-on.
Check the logs of the "SSH & Web Terminal" add-on to see if everything went well.

NOTE: Do not add this repository to Hass.io, please use: https://github.com/hassio-addons/repository.

Docker status

Configuration

Note: Remember to restart the add-on when the configuration is changed.

SSH add-on configuration:

{
  "log_level": "info",
  "ssh": {
    "enable": true,
    "port": 22,
    "username": "hassio",
    "password": "",
    "authorized_keys": [
      "ssh-rsa AASDJKJKJFWJFAFLCNALCMLAK234234....."
    ],
    "sftp": false,
    "compatibility_mode": false,
    "allow_agent_forwarding": false,
    "allow_remote_port_forwarding": false,
    "allow_tcp_forwarding": false
  },
  "web": {
    "enable": true,
    "port": 7681,
    "username": "hassio",
    "password": "changeme",
    "ssl": true,
    "certfile": "fullchain.pem",
    "keyfile": "privkey.pem"
  },
  "share_sessions": true,
  "packages": [
    "python",
    "python-dev",
    "py-pip",
    "build-base"
  ],
  "init_commands": [
    "pip install virtualenv",
    "pip install yamllint"
  ]
}

Note: This is just an example, don't copy and past it! Create your own!

Option: `log_level`

The log_level option controls the level of log output by the addon and can be changed to be more or less verbose, which might be useful when you are dealing with an unknown issue. Possible values are:

trace: Show every detail, like all called internal functions.
debug: Shows detailed debug information.
info: Normal (usually) interesting events.
warning: Exceptional occurrences that are not errors.
error: Runtime errors that do not require immediate action.
fatal: Something went terribly wrong. Add-on becomes unusable.

Please note that each level automatically includes log messages from a more severe level, e.g., debug also shows info messages. By default, the log_level is set to info, which is the recommended setting unless you are troubleshooting.

Using trace or debug log levels puts the SSH and Terminal daemons into debug mode. While SSH is running in debug mode, it will be only able to accept one single connection at the time.

Option group `ssh`

The following options are for the option group: ssh. These settings only apply to the SSH daemon.

Option `ssh`: `port`

The default port for SSH is 22, some security guides recommend to change the port to something else. Sometimes you'd just like to have it on another port. Remember, if you change to port, be sure it is not in use already!

Option `ssh`: `username`

This option allows you to change to username the use when you log in via SSH. It is only utilized for the authentication; you will be the root user after you have authenticated. Using root as the username is possible, but not recommended.

Note: Due to limitations, you will need to set this option to root in order to be able to enable the SFTP capabilities.

Option `ssh`: `password`

Sets the password to log in with. Leaving it empty would disable the possibility to authenticate with a password. We would highly recommend not to use this option from a security point of view.

Option `ssh` `authorized_keys`

Add one or more public keys to your SSH server to use with authentication. This is the recommended over setting a password.

Please take a look at the awesome documentation created by GitHub about using public/private key pairs and how to create them.

Option `ssh`: `sftp`

When set to true the addon will enable SFTP support on the SSH daemon. Please only enable it when you plan on using it.

Note: Due to limitations, you will need to set the username to root in order to be able to enable the SFTP capabilities.

Option `ssh`: `compatibility_mode`

This SSH add-on focusses on security and has therefore only enabled known secure encryption methods. However, some older clients do not support these. Setting this option to true will enable the original default set of methods, allowing those clients to connect.

Note: Enabling this option, lowers the security of your SSH server!

Option `ssh`: `allow_agent_forwarding`

Specifies whether ssh-agent forwarding is permitted or not.

Note: Enabling this option, lowers the security of your SSH server! Nevertheless, this warning is debatable.

Option `ssh`: `allow_remote_port_forwarding`

Specifies whether remote hosts are allowed to connect to ports forwarded for the client.

Note: Enabling this affects all remote forwardings, so think carefully before doing this.

Option `ssh`: `allow_tcp_forwarding`

Specifies whether TCP forwarding is permitted or not.

Note: Enabling this option, lowers the security of your SSH server! Nevertheless, this warning is debatable.

Option group `web`

The following options are for the option group: web. These settings only apply to the Web Terminal.

Option `web`: `username`

This option allows you to enable authentication on accessing the terminal. It is only used for the authentication; you will be the root user after you have authenticated. Using root as the username is possible, but not recommended. Leaving it empty would disable the authentication completely.

Note: If you set an username, password becomes mandatory as well.

Option `web`: `password`

Sets the password to authenticate with. Leaving it empty would disable the authentication completely.

Note: If you set a password, username becomes mandatory as well.

Option `web`: `ssl`

Enables/Disables SSL (HTTPS) on the web terminal. Set it true to enable it, false otherwise.

Option `web`: `certfile`

The certificate file to use for SSL.

Note: The file MUST be stored in /ssl/, which is default for Hass.io

Option `web`: `keyfile`

The private key file to use for SSL.

Note: The file MUST be stored in /ssl/, which is default for Hass.io

Shared settings

The following options are shared between both the SSH and the Web Terminal.

Option: `packages`

Allows you to specify additional Alpine packages to be installed in your shell environment (e.g., Python, Joe, Irssi).

Note: Adding many packages will result in a longer start-up time for the add-on.

Option: `init_commands`

Customize your shell environment even more with the init_commands option. Add one or more shell commands to the list, and they will be executed every single time this add-on starts.

Embedding into Home Assistant

It is possible to embed the Web Terminal directly into Home Assistant, allowing you to access your terminal through the Home Assistant frontend.

Home Assistant provides the panel_iframe component, for these purposes.

Example configuration:

panel_iframe:
  terminal:
    title: Terminal
    icon: mdi:console
    url: https://addres.to.your.hass.io:7681

Known issues and limitations

When SFTP is enabled, the username MUST be set to root.
It is impossible to access the GPIO pins at this moment. There is currently an issue open for fixing this: home-assistant/supervisor#432
The following error may occur in your add-on log, and can be safely ignored:
```
ERR: lws_context_init_server_ssl: SSL_CTX_load_verify_locations unhappy
```

Changelog & Releases

This repository keeps a change log using GitHub's releases functionality. The format of the log is based on Keep a Changelog.

Releases are based on Semantic Versioning, and use the format of MAJOR.MINOR.PATCH. In a nutshell, the version will be incremented based on the following:

MAJOR: Incompatible or major changes.
MINOR: Backwards-compatible new features and enhancements.
PATCH: Backwards-compatible bugfixes and package updates.

Support

Got questions?

You have several options to get them answered:

The Home Assistant Community Forum, we have a dedicated topic on that forum regarding this add-on.
The Home Assistant Discord Chat Server for general Home Assistant discussions and questions.
Join the Reddit subreddit in /r/homeassistant

You could also open an issue here GitHub.

Contributing

This is an active open-source project. We are always open to people who want to use the code or contribute to it.

We have set up a separate document containing our contribution guidelines.

Thank you for being involved! 😍

Authors & contributors

The original setup of this repository is by Franck Nijhof.

For a full list of all authors and contributors, check the contributor's page.

We have got some Hass.io add-ons for you

Want some more functionality to your Hass.io Home Assistant instance?

We have created multiple add-ons for Hass.io. For a full list, check out our GitHub Repository.

License

MIT License

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

README.md

README.md

Community Hass.io Add-ons: SSH & Web Terminal

About

Features

Installation

Docker status

Configuration

Option: `log_level`

Option group `ssh`

Option `ssh`: `port`

Option `ssh`: `username`

Option `ssh`: `password`

Option `ssh` `authorized_keys`

Option `ssh`: `sftp`

Option `ssh`: `compatibility_mode`

Option `ssh`: `allow_agent_forwarding`

Option `ssh`: `allow_remote_port_forwarding`

Option `ssh`: `allow_tcp_forwarding`

Option group `web`

Option `web`: `username`

Option `web`: `password`

Option `web`: `ssl`

Option `web`: `certfile`

Option `web`: `keyfile`

Shared settings

Option: `packages`

Option: `init_commands`

Embedding into Home Assistant

Known issues and limitations

Changelog & Releases

Support

Contributing

Authors & contributors

We have got some Hass.io add-ons for you

License

Files

README.md

Latest commit

History

README.md

File metadata and controls

Community Hass.io Add-ons: SSH & Web Terminal

About

Features

Installation

Docker status

Configuration

Option: log_level

Option group ssh

Option ssh: port

Option ssh: username

Option ssh: password

Option ssh authorized_keys

Option ssh: sftp

Option ssh: compatibility_mode

Option ssh: allow_agent_forwarding

Option ssh: allow_remote_port_forwarding

Option ssh: allow_tcp_forwarding

Option group web

Option web: username

Option web: password

Option web: ssl

Option web: certfile

Option web: keyfile

Shared settings

Option: packages

Option: init_commands

Embedding into Home Assistant

Known issues and limitations

Changelog & Releases

Support

Contributing

Authors & contributors

We have got some Hass.io add-ons for you

License

Option: `log_level`

Option group `ssh`

Option `ssh`: `port`

Option `ssh`: `username`

Option `ssh`: `password`

Option `ssh` `authorized_keys`

Option `ssh`: `sftp`

Option `ssh`: `compatibility_mode`

Option `ssh`: `allow_agent_forwarding`

Option `ssh`: `allow_remote_port_forwarding`

Option `ssh`: `allow_tcp_forwarding`

Option group `web`

Option `web`: `username`

Option `web`: `password`

Option `web`: `ssl`

Option `web`: `certfile`

Option `web`: `keyfile`

Option: `packages`

Option: `init_commands`