Remote access

Remote access

Kelpy listens on 127.0.0.1 only. From another computer, use the server's own SSH with a tunnel (see Installation and first run), or start Kelpy with its own SSH server:

kelpy --ssh 2222

--ssh without a port lets the system choose one. The start-up lines, or the terminal UI's header, then show the port, the server's host key fingerprint and the command to connect, such as ssh -p 2222 admin@<this server>. Check the fingerprint at the first connection: it is made at the first start and kept in data/ssh_host_ed25519_key.

Approving each connection

Kelpy's SSH server accepts keys only, never passwords. Once a key is checked, the connection waits until you allow it, in the terminal UI (Ctrl+Y allow, Ctrl+N deny) or in a Web UI page already signed in, which shows who connects: the address, the user name and the key's fingerprint. Nobody deciding within 2 minutes refuses it, and a connection refused once is not asked for again with another of its keys. Allow only a connection you expect: an allowed one uses Kelpy as you do.

For unattended use, --allow-key SHA256:... lets the key with that fingerprint in without asking; repeat it for several keys. ssh-keygen -lf ~/.ssh/id_ed25519.pub shows a key's fingerprint.

Every connection, its decision and its end are written to logs/remote.log in the Kelpy home.

What a connection can do

Channel	Allowed
Terminal	Kelpy's terminal UI: ssh -t -p 2222 admin@server. Closing it leaves Kelpy running
Commands	none: Kelpy runs no command or shell over SSH
SFTP	the files uploaded to Kelpy (workspace/files/), and nothing else: sftp -P 2222 admin@server. Names follow the Web UI's rules, a link in the folder is never followed, and a file grows to 2 GiB at most. Uploads resume by offset; appending is not supported
Forwarding	to the Web UI's port only: ssh -N -p 2222 -L 54321:127.0.0.1:54321 admin@server, then open the Web UI link

Forward the Web UI's own port number, as Kelpy accepts requests only for the address it printed. At most 8 sessions are open at once, each with at most 8 channels (terminal UIs, SFTP sessions, forwards), and 16 connections waiting to sign in. A connection has 10 seconds to start and 2 and a half minutes to be allowed; a session idle for an hour is closed.

While Kelpy can be reached

With --ssh and no other limit, Kelpy stops after 1 hour without activity, as if started with --shutdown-idle 1h; --shutdown-idle or --shutdown-after set another limit. When Kelpy stops, every SSH session ends with it. The SSH server listens on every address of the server: open its port in the firewall only for the addresses you connect from.