Gate One Brings Text-mode Surfing To the Web, Quake-Style

Riskable writes "As a follow-up to my previous Slashdot story, Gate One is now out of beta. Packages can be downloaded here. There's also a live demo: press the ESC key on this page to have a terminal running lynx drop into view, Quake-style! I've also posted a video overview and the documentation can be found here. Some pertinent changes since the beta: Added the ability display images inline within terminals, key-based SSH authentication, a WebSockets authentication API (for secure embedding), dramatically improved terminal emulation, an overhauled bookmark manager, support for international keyboard layouts, and a web-based log viewer that lets you export logs to self-contained HTML playback files."

Comments

Dude!

[Anonymous Coward]

What have you been smoking?

English please

[Anonymous Coward]

Is this an SSH client embedded in a web page?

Re:English please

[ThePhilips]

And if yes, how long do you think would it take for black hats to adopt it to DDoS SSH servers using an army of zombie PCs?

More of a Wolfenstein and Doom fan

[Anonymous Coward]

But I'll settle for any iD game, really.

Error msg ...

[dgharmon]

"Some web proxies do not work properly with Web sockets"

Am I missing something?

[gid]

Pressing ESC does nothing in Chrome or Firefox, and produces a not supported error in IE9.

Re:Am I missing something?

[olsmeister]

Slashdotted already.

Re:Am I missing something?

[tehcyder]

Didn't work on Opera either, even though the error messageit said it should...

Servers ran out of memory

[Riskable]

LOL, that'll teach me to use Rackspace's cheap servers. Setting up new ones now with more memory... Should start working again in a bit.

Re:Servers ran out of memory

[Hero Zzyzzx]

Why do you need significant server resources if this is completely client side? Static files should fly like the wind on pretty much any respectable host.

Re:Servers ran out of memory

[Riskable]

OK, I just setup four new servers running Gate One with 4GB of RAM each. If that's not enough I'll just put up more :)

Feel free to try the demo again.

Re:Servers ran out of memory

[nman64]

You've obviously never pitted Slashdot against a cheap VPS. Even serving static files, the traffic of a good slashdotting will bring a lightweight server to its knees, and this is a story related to SSH.

Re:Servers ran out of memory

[Hero Zzyzzx]

Not bragging, but I have, many times. If you're serving static files and have enough outgoing bandwidth, you can easily survive a slashdotting if your web servers are properly tuned, apache or nginx.

Re:Servers ran out of memory

[Riskable]

Because it isn't completely client side. Every time you open a new terminal it spawns a new shell and server-side terminal emulator to run it. Gate One wasn't really made to handle a slashdotting but I believe I can make adjustments if necessary to make it work. If the load stays this steady everything should be running smoothly for the rest of the day :)

Re:Servers ran out of memory

[Hero Zzyzzx]

My assumption that it was completely client side was wrong, of course. There's a python backend that probably handles a lot of the heavy lifting. . . yeah, not going to enter my username/password into this demo, sorry. It does look great, though, and I may look at a self-hosted install.

Re:Servers ran out of memory

[Hero Zzyzzx]

Thanks! Had I looked at the docs that would've been evident.

Re:Servers ran out of memory

[Riskable]

You're right: The four webservers I setup to serve liftoffsoftware.com are barely breaking a sweat right now. Load average on all of them is about 0.02. It is low enough that I'll be taking one or two of them offline I think (why pay for what I don't need?). I also want to mention that I *did* tune them considerably and even modified the Drupal theme to serve up many of the static files via a CDN.

It is the Gate One servers that needed the beefy resources since each open terminal needs to take up enough memory to be stored/kept track of inside of the Python interpreter. 90% of the load there (from a Slashdotting) is memory and I can't believe I didn't foresee this. Lesson learned.

Having said all that I believe I went way overboard by setting up four 4096MB Gate One servers. Here's the line from 'top' on one of the Gate One servers right now (as I'm being slashdotted):

1203 1165 3:51.43 36 5.3 20 0 S 980m 768m 211m 0 python ./gateone.py

That's with Google Analytics showing ~400 users on the site right now.

5.3% memory utilization is nothing and as long as everyone doesn't stick around surfing the web all day in text mode that number will probably never rise above 10%. I'll be watching it and likely be swapping these servers out with 1GB ones. I love on-demand cloud hosting!

Re:Servers ran out of memory

[Anonymous Coward]

I still can't get it to work. I press esc and nothing happens in Chrome.

Re:Servers ran out of memory

[Anonymous Coward]

Slashdotting ain't what it used to be.

Re:Servers ran out of memory

[justforgetme]

My idea exactly. Are they going to open up the code for this?
But from where I'm sitting I can't see how this is different from a Terminal emulator running on you own host over https.
I had setup one of those once, there are a number of terminal emus as js standalones. You just wire it up to a script that
evals the input onto the linux https server and returns the output.

Re:Servers ran out of memory

[justforgetme]

Well, it could be that your chrome is broken :-)

No, really I have seen many chrome implementations (especially win XP & 7) where basic stuff like the location object is badly corrupt.
It usually tracks down to malware or cracked software, but is easily fixed with a reinstall (that's remove -> install. not upgrade)

Re:Servers ran out of memory

[XrayJunkie]

... and this is a story related to SSH.

I just read Quake-style ...

From the Homepage

[wisnoskij]

Gate One is a web-based Terminal Emulator and SSH client that brings the power of the command line to the web. It requires no browser plugins and is built on top of a powerful plugin system that allows every aspect of its appearance and functionality to be customized.

So it is a SSH client embedded in the web.

But the second half seems self contradictory to me.
"It requires no browser plugins" but it is "built on top of a powerful plugin system"
So it does not require any plugins, but is a plugin?

Re:From the Homepage

[Narcocide]

So it does not require any plugins, but is a plugin?

I think they just meant to say the code is designed in a modular fashion, so you don't have to load it all at once.

Re:From the Homepage

[nman64]

Not at all contradictory. It does not require the use of browser plugins, but the Gate One application supports its own plugins for customization.

Re:From the Homepage

[Riskable]

The other replies covered this already but I thought I'd provide an authoritative answer: It isn't contradictory. Gate One requires no browser plugins but is itself built on top of a plugin architecture. For example, the SSH capabilities all come from a single plugin.

Re:From the Homepage

[wisnoskij]

So does that mean that to use the SSH you need to install the Gate One "SSH capabilities" plugin or not?

I still don't understand what they mean by that sentence.

Re:From the Homepage

[Riskable]

To answer your question: Gate One comes with the SSH plugin pre-installed and enabled. So it's ready-to-go as an SSH client "out of the box" as it were.

As for the plugin architecture, it's not as complicated as it sounds. There's a "plugins" directory. In that directory there's individual plugins such as "ssh" (which is its own directory): /opt/gateone/plugins/ssh

When you execute gateone.py it will scan the plugins directory for plugins and load them accordingly. Plugins can be written in any combination of Python, JavaScript, and CSS (yes, in theory you could make a CSS-only plugin). As an example, here's the layout of the SSH plugin directory:

root@portarisk:/opt/gateone/plugins # ls -lR ssh
ssh:
total 48
drwxr-xr-x 2 root root 4096 2012-02-26 12:29 scripts
-rw-rw-r-- 1 root root 36473 2012-02-09 12:24 ssh.py
drwxr-xr-x 2 root root 4096 2012-02-21 09:12 static
drwxr-xr-x 2 root root 4096 2012-02-07 15:25 templates

ssh/scripts:
total 60
-rw-rw-r-- 1 root root 5708 2012-02-13 10:36 logo.png
-rwxr-xr-x 1 root root 30576 2012-02-26 12:29 ssh_connect.py

ssh/static:
total 56
-rw-r--r-- 1 root root 54852 2012-02-21 09:12 ssh.js

ssh/templates:
total 8
-rw-rw-r-- 1 root root 5052 2012-02-07 15:23 ssh.css

So in this example the SSH plugin is taking advantage of all three supported plugin types simultaneously: Python, JavaScript, and CSS. Each type will be loaded appropriately... Python files will be imported and their 'hooks' will be attached accordingly, JavaScript files will be automatically added to whatever page is loading Gate One, and CSS files will be automatically added to the HEAD tag of the page. It's all seamless and happens automatically by simply placing the files in the correct locations.

That 'scripts' directory is just somewhere to store that ssh_connect.py script which is what gets called when Gate One spawns a new terminal (by default). Just think of the 'scripts' directory as an arbitrary place to store a non-plugin file or two (I could've just placed them inside the 'ssh' directory but that wouldn't be very organized =).

Cool fact: Gate One loads JS and CSS files over the WebSocket.

Re:From the Homepage

[wisnoskij]

"Gate One comes with the SSH plugin pre-installed and enabled."
How do you pre-install something without access to my computer?
So you do have to install something? and that installation involves installing a browser plugin, just like they specifically said that you did not need to do?
Or are you saying that your online profile comes with an online "plugin" that is virtually "pre-installed" to your completely online account?

Lets pretend I am just a normal IE, firefox, or chrome user who has never heard of Gate One before.
I do not even have an admin account and I am in a library that locks down their computers from change.
Can I use Gate One? or does something need to be installed?

Re:From the Homepage

[Riskable]

You're confused: Gate One runs on a server. You connect to that server with your browser.

Step 1: Install Gate One on a server somewhere.
Step 2: Open up your browser and connect to your Gate One server.
Step 3: ...
Step 4: Profit!

Note: Gate One can actually run on just about anything with Python installed. I've got it installed and running on my router at home, for example :)

Re:From the Homepage

[wisnoskij]

Ah, so you are offering a software package that allows the user to turn one of his computers into a webhost that hosts a website which gives command line access to that same server?

Interesting.

So, kindof like a Linux alternative to those remote desktop through the browser deals.

Re:From the Homepage

[justforgetme]

that + since it is (or will be?) open source it will be quite easy to design and implement plugins for the js application.

Re:From the Homepage

[snookums]

Lets pretend I am just a normal IE, firefox, or chrome user who has never heard of Gate One before.
I do not even have an admin account and I am in a library that locks down their computers from change.
Can I use Gate One? or does something need to be installed?

Gate One is something that is installed on a server, not your computer.

Nothing needs to be installed on your computer to use it, other than a compatible, modern web browser.

The administrator of the website using Gate One can install Gate One modules (not browser plugins) on the server, and you the user will immediately have access, via your web browser, to the funcationality that those modules provide.

Re:From the Homepage

[Anonymous Coward]

I wish you could mod posts "Idiot" or something in the lines of that... What are you even doing on slashdot and especially in this article?

Slashvertishment

[monjemono]

As this looks like advertishment to me, I will post about my own UNIX web terminal emulator. Its C, executable only 100kb for the executable with everything contained, and many of the goodies from GateOne (multiple sessions, session attached to user, not browser window...) It also even has colaborative terminal, where two users can attach to the same terminal. All AGPLv3. https://github.com/davidmoreno/onion/tree/master/examples/oterm

Re:Slashvertishment

[Anonymous Coward]

For non commercial use, Gate One seems to use the same licence.

Re:Slashvertishment

[Hatta]

How do you deal with permissions in a collaborative terminal environment? Does everything just get the permissions of the user running the terminal?

Re:Slashvertishment

[monjemono]

The terminal gets the permissions of the user running the terminal. If ran as root it auths using PAM and if successful it does setuid().

When sharing users pass around URLS (with an UUID) for that terminal, with the permissions of the user that started it.

David.

Bravo from the ajaxterm author

[Anonymous Coward]

I'm the author of ajaxterm which was one of the first web based terminal and is still quite popular even if i dont maintain it anymore. I was not aware of this project, i find GateOne impressive maybe it's time to ditch rxvt :)

Antony lesuisse

Re:Bravo from the ajaxterm author

[Riskable]

THANK YOU SIR! It was AjaxTerm that lead me to develop Escape From The Web which was an HTTP streams-based predecessor to Gate One. If it weren't for AjaxTerm's example of how to write such an application I probably would've never gotten around to making Gate One.

So thanks again; Gate One wouldn't have been possible if you never shared your code.

Re:Bravo from the ajaxterm author

[Anonymous Coward]

can you feel the love here tonight ladies and gentlemen? honestly, both you guys rock! the slashdot crowd is sometimes too cool to say "ah! this is too cool!" btw my first post even if it is anonymous.

Re:Bravo from the ajaxterm author

[tom17]

Can I just say thanks to BOTH of you guys. I used to use AjaxTerm a while back. More recently, I found a way out on port 22 so don't need anything like that right now.

Even so, I installed GateOne and really quite like it. One thing, however, is that I have not yet got WebSockets (interesting stuff) working with a reverse proxy in Apache so I will have to have a play around with that at some point. I use Apache as my main front-end for any apps to my home stuff using mod_proxy and don't fancy switching it all up to nginx just yet...

Thank you sirs!

Collaborative terminal. The end of cooperation.

[wreakyhavoc]

I took a look at the site and it sounds like they are hammering on the copy/paste functionality. Well, and the Sarbanes/Oxley and ISO compliance.

But seriously, Collaborative Terminal? Sounds like a pit of snakes. I'm sure it's very lovely in person.

Re:Collaborative terminal. The end of cooperation.

[Anonymous Coward]

So... "collaborative terminal", huh?

And in case you didn't see it...

[Anonymous Coward]

Quake-style!

Re: Oh Timmy...

[Anonymous Coward]

If by "slashvertisement" you mean "submission by a very long term (5 digit UID) slashdot regular about an open source project he created that many slashdotters are interested in", then yes, "Timmy" is getting pretty heavy on those.

Re: Oh Timmy...

[Anonymous Coward]

Defending your slashvertisement submission as AC is pretty lame.

Lynx - cool!

[Grindalf]

I love lynx, but does it have the ability to put the screen in monocolor without recompiling the binary? I often wind up using "Links" to fit in with with my usual mono color POSIX / BSD look and feel spec machine because of this. Out of idle curiosity, has anyone got the svga lib graphics version to work at the command line?

Re:Lynx - cool!

[Sodki]

$ lynx --nocolor

But you should give elinks a try instead of lynx. elinks supports frames, tabs and mouse input.

Re: Oh Timmy...

[Anonymous Coward]

I'm here too. Don't forget about me.

Firefox No Worky!

[Anonymous Coward]

Sorry, your browser doesn't support WebSockets so the demo won't work. Gate One is known to work wonderfully in Chrome and Firefox and should also work in Opera and IE 10 (when it is officially out).

Seen from using Firefox 4.01

Re:Firefox No Worky!

[Anonymous Coward]

Seen from using Firefox 4.01

Works fine here, though I bothered to upgrade in the last three seconds and am using Firefox 121221588.33.m/2

One question

[eternaldoctorwho]

What is Quake-style? I must not have payed attention when I played Quakes 1 and 2, but I don't remember lynx being in there....Google doesn't really help me with the answer on this either.

Re:One question

[gl4ss]

that the terminal drops down. that's the quake style reference, that you press esc and tada you got a terminal. of course quake didn't do it by default from esc...

Re:One question

[jimshatt]

The dev console. Pretty common in FPS games (in my day at least). Usually accessed by pressing tilde (~).

Re: Oh Timmy...

[Anonymous Coward]

many slashdotters are interested in

You'd be wrong about that.

Quake?

[identity0]

>impulse 9
>No command found

Nope, can't seem to mod slashdot with a rocket launcher.

But man, this story is giving me nostalgia flashbacks...

Re: Oh Timmy...

[gl4ss]

many slashdotters are interested in

You'd be wrong about that.

this is the most interesting new web-related thing in a long time, previously you needed java applets to attain this as smoothly as this(it wasn't as smooth). to top that up, the author has been commenting as well as the author of a project that inspired this project. best slashdot of the year perhaps.

Re: Oh Timmy...

[Score Whore]

You're forgetting the most exciting part! He gets to collect everyone's usernames and passwords. How sweet!

Doesn't work for me

[guruevi]

I used Opera and Safari and neither works.

My question is... how does it work. Is it a fully JavaScript/Ajax terminal? Is it using the GateOne servers as a gateway? Is it using a script on someone else's server? What are the security implications of this? How easy would it be to implement this on a malicious page or hack someone's server and modify this to capture keystrokes or SSH keys? Does it support SSH keys?

Drag?

[s.petry]

Well, I hit escape and see a message regarding proxy servers.. which is probably the cause. Does anyone have a work around for "Brucoat" handy? Product looks very interesting.. but if I can't use it.. :(

Quake Style?

[Anonymous Coward]

Why can't I find the nailgun?

Man in the middle...

[Anonymous Coward]

In other news, CIA funded man in the middle attacks were discovered in open source products today...

Yo dawg

[Anonymous Coward]

I heard you like web browsers...

Opera

[Anonymous Coward]

It's a pity it doesn't work in Opera, though.

Elinks vs Lynx

[Sodki]

You should have used Elinks instead of Lynx. Elinks supports frames, tabs and mouse input.

Great package!

[s.petry]

Instead of trying to mess around with trying to proxy, I downloaded and installed. There should be some note with the Tornado package that it does not create the links to the current (not hard to fix but easier if you know). Once the link was created for Tornado, Gateone was up and running within a minute.

Since I have Apache and Tomcat running on this host, I had to change the port. May be worth adding something to the initial run of Gateone to check for port 80 and 443 to be open before trying to stomp on other services, and maybe request a port number if it finds the defaults in use?

That was it though for getting the product up and running. Like butter with a few toast crumbs left in the bowl.. mostly very smooth but had to pick out a couple crumbs. I pointed our Wintel admin to the site to get his take. IE9 seems to hang and never do anything but load the background. Firefox and Chrome work like a champ.

Re:Great package!

[Riskable]

IE 9 doesn't support WebSockets but IE 10 will. Having said that, I do have plans to include friendlier error messages for browsers that lack support for certain things. Under normal circumstances I would have supported IE but Flash-based WebSockets and other workarounds were just too slow or too bandwidth-heavy in my testing to be worthwhile. They might be OK for a single terminal but for multiple terminals they're terrible. Having said that I *do* re-test such things from time to time to see if things have improved (i.e. Flash could get faster) so it might change in the future.

For reference, supporting IE adds twice the development time to any web project! It can also double the size of the code base and drastically increases the likelihood of bugs. It's THAT bad. Hopefully IE 10 will be better but I said that about IE 9 before it came out (sigh).

Also, if you don't need to support IE your JS code suddenly becomes easy to read and starts to make sense!

Re: Oh Timmy...

[Riskable]

In regards to your comment I'd like to make the following statements:

1) This is why I setup the demo to run lynx instead of a the regular SSH client... So usernames and passwords wouldn't be a concern (and to avoid liability). Unless you had plans to surf the web all day in text mode at liftoffsoftware.com (logging into things) I can't fathom how this could be a real issue.
2) I would never record anyone's usernames/passwords. Of course, you'd just have to trust me and I definitely understand if you don't. I myself try not to trust 3rd party websites with much. For reference, I'm not even logging what sites users are visiting in lynx. It isn't the point so why would I?
3) By default Gate One doesn't log incoming keystrokes. In order for that to happen you have to set logging to debug (--logging=debug). If logging is set to debug Gate One will display a HUGE warning message to users whenever a terminal is opened, "WARNING: Logging is set to DEBUG. All keystrokes will be logged." Of course, being the developer I could just turn that off but at least I had the foresight to include a user-friendly message.
4) It is trivial to replace sshd with a malicious copy that records user's keystrokes. Gate One is no more or less secure than OpenSSH from that standpoint. Users wouldn't even see a message that the host key had changed.