Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Provide some level of integration with a GUI #4

Open
sorenisanerd opened this issue Apr 14, 2021 · 0 comments · May be fixed by #6
Open

Provide some level of integration with a GUI #4

sorenisanerd opened this issue Apr 14, 2021 · 0 comments · May be fixed by #6
Assignees

Comments

@sorenisanerd
Copy link
Owner

Use case: Suppose I want to launch a GUI from the tty I'm connected to. There are excellent SPiCE clients (e.g. https://github.com/eyeos/spice-web-client) that we can use.

We need a few things to make this work well:

  1. Embed websockify in GoTTY. It needs to be explicitly enabled when launching GoTTY for security reasons.
  2. Add an escape sequence to tell the webtty that e.g. a vnc or spice server is available. E.g. "]9876;spice://10.20.30.40:5442;credentials".
  3. The webtty can then connect GoTTY's websockify path, send "10.20.30.40:5442" as the target IP:port and GoTTY will connect it.
  4. Once the connection is established, it can be passed along to a js spice client.

This may or may not be a security concern. Let's look at three scenarios:

  1. For the common use case where you run e.g. "gotty -w bash", the user lands in a bash prompt where they can just netcat their way to any other system. Giving them access via websocket to that same network should not be a concern.
  2. If you're using gotty to just show something, e.g. "gotty top", the user can't even interact with top, but only see its output. In that case, giving them free reign to connect to arbitrary systems on the server network is obviously terrible.
  3. If you're doing e.g. "gotty -w login -", you'll be presented with a login prompt. In other words, the authentication step is outside of GoTTY's control.

If we only had to worry about scenarios 1 and 2, we could simply use the "-w" flag to decide whether to allow this websockify mechanism. Because of scenario 3, it needs to be a separate flag. It should restrict the access to specific hosts/ports.

@sorenisanerd sorenisanerd self-assigned this Apr 19, 2021
@sorenisanerd sorenisanerd linked a pull request Apr 19, 2021 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant