What’s a safe, inexpensive way to use SSH from a locked-down library computer?
Asked by
MellowPine47
I want to write and run code from library computers that don't allow console access or application installation. My plan is to keep my development tools and Neovim on a cheap VPS, then connect to it through a terminal that runs in the browser. I'm looking for a secure, lightweight solution that works from a public computer. Options I've come across include browser SSH extensions, Cockpit, Cloudflare tunnels, and Tailscale, but I'm not sure which is most appropriate. I mainly want a normal SSH-like terminal rather than a full web development environment.
Answers
Tailscale is a good choice for avoiding an openly exposed SSH port, but it doesn’t by itself give you a terminal page in an ordinary browser. You’d still need a browser-compatible terminal service or a device that can run the Tailscale client. If you use a Cloudflare tunnel instead, protect the published terminal with an access policy and MFA; don’t publish a raw shell endpoint without authentication.
Reply to this answer
A hosted browser IDE such as Codespaces or a provider’s web console would work if you’re comfortable using a larger environment, but it’s probably more than you need. For a simple VPS workflow, a small VPS plus a properly secured ttyd-style service is the most direct approach. If your goal is only editing, testing, and running scripts, you don’t need a full VS Code setup.
Reply to this answer
A Chrome SSH extension can connect directly to an SSH server without needing a separate web terminal backend. One option is based on hterm and even includes experimental Mosh support. The main limitation is that it may be restricted to a particular browser, and the library network could block outbound SSH connections. You’d also want to be very careful about leaving keys, passwords, or shell history behind on a shared computer.
Reply to this answer
For a self-hosted browser terminal, ttyd or Gotty is probably closer to what you want than Cockpit. They expose a terminal through a web page using a WebSocket connection and have much less overhead than a full administration dashboard. Put it behind HTTPS, require strong authentication, and ideally restrict access with a VPN or identity-aware proxy rather than exposing an unauthenticated terminal to the internet.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions