HTTP(/S) based CLI client for connecting to servers

[JonTheNiceGuy]

I have found this service, as it was suggested it's close to the AWS SSM Service, but the killer feature that SSM has, which you don't, is a Command Line client that can connect over HTTP or HTTPS through the Shellhub system to the remote server, like this:

(assuming your public URL for your shellhub service is http://shellhub.service and the device you're connecting to is in the namespace namespace, with the hostname hostname)

shellhub config uri https://shellhub.service
shellhub config token <some API token>
shellhub [email protected]

OR, like SSM, configure .ssh/config with a line like this:

host namespace.*
    ProxyCommand sh -c "shellhub start-session --token <some API token> --service https://shellhub.service --target %h"

then you can run ssh [email protected] which would establish the SSH session over the Shellhub service, but only using HTTP(/S).

[otavio]

The standard ssh command works fine to connect to the devices abroad. As you can see at our docs we offer two ways to connect to the device: SSH over WebSocket and our SSH gateway. So you can connect using the web terminal or from the command line or other SSH clients (such as PuTTY).

For this to work, we use an agent which you can install using Docker, standalone, or even inside Embedded Devices using Yocto Project.

I believe the ShellHub and AWS SSM try to cover different use cases. So you can choose the one which better serves you.

[JonTheNiceGuy]

Hi, thanks for taking the time to reply to my request! I took a look at the project, and it's definitely a great idea! I agree that SSM and ShellHub currently have different usecases, but I think ShellHub could probably be extended just a little bit to cover this usecase ;) but that said, I think this was more to see if there was the appetite to add this feature, rather than necessarily to push ahead and get it in! I'll close this for now, but someone else could always reopen it later if they've got a compelling argument for it, or (even better) with a PR :)

[otavio]

We're always looking for great ideas and suggestions but I didn't understand what feature or use case you are looking for. It seems it covers the use case you mentioned. Am I missing something?

[JonTheNiceGuy]

The main thing is that I'm looking for something which will let me expose just an HTTP endpoint, and provide SSH access over that. The web interface doesn't provide quite enough console for me (basically, I'd like a resizeable window). Ideally, I'd also like to be able to run SSH from the command line in systems which only provide HTTP(S) access (e.g. constrained guest wifi) and still have it work, without exposing my SSH server. Longer term, I'd love to be able to run VSCode on my laptop, using the remote extension to SSH (via Shellhub), and still access connections beyond the endpoint - but that relies on port forwarding which isn't yet available (#90). Ultimately, I think I'm trying to bend this product into something it isn't, but it's just where my head went first!

[otavio]

@JonTheNiceGuy it already works (the HTTPS access without exposing SSH port) as the client does not use the SSH port to connect to the server but does it inside HTTP with WebSocket.

Only the ShellHub server exposes the SSH port and it works as a bastion server to the clients. But this seamlessly.

Port forwarding is still not done.

[JonTheNiceGuy]

So, is there a way from a command line to establish an SSH session over an HTTPS service? If so ... 🤤 😁

[otavio]

Yes, it can be connected using the standard ssh client to connect to the bastion server (ShellHub server) using the SSHID and it establishes the connection to the desired device over HTTPS protocol.

[JonTheNiceGuy]

Ahhh, I'm talking about the first leg - from the CLI to the HTTPS endpoint - I'm not quite as bothered by the second leg from the HTTPS Server to the target machine (although, that's still interesting - just not the piece I want to know about right now)

[otavio]

We don't support terminal over HTTPS using a CLI. We accept sponsoring for patches for adding it though ;-)