[dashboard] support connect via SSH #9003

iQQBot · 2022-03-29T15:14:01Z

Description

Now that we have the new SSH gateway and the simpler authentication flow, it is possible that a user can copy/paste an SSH command onto their local machine to facilitate quicker/easier access to a Gitpod workspace.

This PR introduces a way to direct connect ssh to workspace

Related Issue(s)

Fixes #7713

How to test

start a workspace in preview environment, you can see Connect via SSH in workspace list and workspace start page(desktop IDE)

Release Notes

support direct connect workspace via ssh command

Documentation

iQQBot · 2022-03-29T15:15:46Z

@gtsiolis UX is slightly different from the design, because the connection of a single command requires many preconditions, please take a look

iQQBot · 2022-03-29T15:19:26Z

@loujaybee Manual connections are the most compatible way to connect, and users can use any ssh client, such as ssh command or putty or other tools to connect

The one-command connection has many prerequisites, such as sshpass in this case, which needs to be installed separately and is not included in the operating system by default, and the installation method is slightly different for each operating system

gtsiolis · 2022-03-29T16:22:13Z

Looking at this now! 👀

gtsiolis

@iQQBot Thanks for pushing this forward! 🏀

UX changes using the modal look good.

However, I left some comments about UX and security practices here as these could affect the adoption of this feature.

Long-term exposing the password like this seems unessasary and can be avoided. I'd like to suggest the following approaches but I'm not sure if these will increase significantly the scope of this PR:

🅰️ Use the standard commands or binaries that ship with most operating system like ssh, curl, or something similar that could allow use to have a single command to copy and paster as well as authenticate via browser. Thus, avoiding and dropping all together sshpass support.
🅱️ Introduce an SSH Keys section in user settings so that users can upload their public SSH key as they usually do with GitLab, GitHub, etc sto that there's a single command to cipy and paste that is using the public key to connect securely to the workspace. This would require a new section in user settings as well as alert in the connect via SSH modal that warns this is a requirement or not set.

Looping in @akosyakov and @loujaybee to decide whether we'd like to a) ship this as is and iterate or b) step back and go with one of the 🅰️ or 🅱️ option described above. 🛹

gtsiolis · 2022-03-29T16:25:28Z

components/dashboard/src/workspaces/ConnectToSSHModal.tsx

+            ),
+        },
+        {
+            key: "sshpass",


issue: While this seems efficient do we really want to promote tools like this? Are you regularly using this, @iQQBot? I could be wrong but I assume many users will be against installing tools like this simply to use SSH access.

I've never actually used it, I've only seen it used in a demo by @csweichel 😂

sshpass is the common way to pass credentials to SSH on the commandline, i.e. it's not an uncommon tool. That said, it might not be installed everywhere.

In both cases: manual and sshpass we should provide documentation that explains how this ought to be used.

I'd almost argue for removing the sshpass for now, but offering a single commandline is just too sweet.

We actually support workspaceID#ownerToken@ideUrl for single command connections

But this has to be based on the fact that the user implicitly provides a priavate_key which is the default id_rsa for authentication, we don't authenticate the user's private key, we just skip the step of having to enter a password through this mechanism. That said, if the user does not have any default privatekey, then the user will still be asked to enter the password.

We can change the behavior of the SSHGateway so that it can log in with any password if it provides full authentication information like workspaceID#ownerToken, but users must also be told this

#9003 (comment) And with a program like this, the user will be confused as to how the input should be done

To ease the burden of education in this area, I chose to provide sshpass and host username password respectively.

CC @csweichel

Wow, that's a neat hack :)

It is also a bit indirect and harder to understand.
Frankly I'd vote for going for the manual/sshpass options as they stand and make sure we have really good documentation for both cases in place.

components/dashboard/src/workspaces/ConnectToSSHModal.tsx

components/dashboard/src/start/StartWorkspace.tsx

iQQBot · 2022-03-29T17:01:57Z

@gtsiolis Thanks for your suggestion

🅰️ Use the standard commands or binaries that ship with most operating system like ssh, curl, or something similar that could allow use to have a single command to copy and paster as well as authenticate via browser. Thus, avoiding and dropping all together sshpass support.

Unfortunately, native ssh does not support passing passwords, much less browser authentication

🅱️ Introduce an SSH Keys section in user settings so that users can upload their public SSH key as they usually do with GitLab, GitHub, etc sto that there's a single command to cipy and paste that is using the public key to connect securely to the workspace. This would require a new section in user settings as well as alert in the connect via SSH modal that warns this is a requirement or not set.

Maybe it can be a solution, but we need to consider

if the user uploads the ssh publickey, then there is a chance that multiple users will duplicate it (inevitably some people have little awareness of security and use some online public key) so it may be used by some people instead
if we help the user to generate random key pairs, then the user can download the private key, this can prevent the publickey duplication, but the burden for the user will become heavy, they need to use special parameters each time to choose the gitpod privatekey

csweichel · 2022-03-29T17:07:01Z

Long-term exposing the password like this seems unessasary and can be avoided.

💯

I'd like to suggest the following approaches but I'm not sure if these will increase significantly the scope of this PR:

🛹 🛹 🛹 🛹 🛹 🛹 🛹 🛹 🛹

🅰️ Use the standard commands or binaries that ship with most operating system like ssh, curl, or something similar that could allow use to have a single command to copy and paster as well as authenticate via browser. Thus, avoiding and dropping all together sshpass support.

We could offer some curl https://... | sh like experience. The URL folks would download would be a one-time secret (i.e. it can be downloaded only once). This way we could protect the owner token and would not make it part of logs and terminal history. We'd still need to find a way to pass the password to SSH - sshpass is surprisingly complex, but we could consider offering a static build so that people don't need to install it on their own.

Security-minded users would not execute anything curl ... | sh though. In that sense sshpass is way more transparent.

🅱️ Introduce an SSH Keys section in user settings so that users can upload their public SSH key as they usually do with GitLab, GitHub, etc sto that there's a single command to cipy and paste that is using the public key to connect securely to the workspace. This would require a new section in user settings as well as alert in the connect via SSH modal that warns this is a requirement or not set.

This is definitely where we want to go. It's also a considerable change, we'd need to

add UI and API to accept the user's public key. Maybe we can pull this from GitHub (what about the other hoster)
push the through server -> ws-manager -> pod -> ws-proxy
support that key in the SSH gateway functionality of ws-proxy

iQQBot · 2022-03-29T17:20:20Z

🅱️ Introduce an SSH Keys section in user settings so that users can upload their public SSH key as they usually do with GitLab, GitHub, etc sto that there's a single command to cipy and paste that is using the public key to connect securely to the workspace. This would require a new section in user settings as well as alert in the connect via SSH modal that warns this is a requirement or not set.

This is definitely where we want to go. It's also a considerable change, we'd need to

add UI and API to accept the user's public key. Maybe we can pull this from GitHub (what about the other hoster)
push the through server -> ws-manager -> pod -> ws-proxy
support that key in the SSH gateway functionality of ws-proxy

Yes, it is a good program, but I think we need to consider I mention above

if the user uploads the ssh publickey, then there is a chance that multiple users will duplicate it (inevitably some people have little awareness of security and use some online public key) so it may be used by some people instead, If you analyze this from a security perspective alone, it doesn't pose a very big threat because the workspaceID is also random, but once we can get the user's publicKey we can do a lot of cool things, like @csweichel mentioned a while back with gitpod cli https://gitpod.slack.com/archives/C01KGM9DVRC/p1644171231400999 In this case, it's slightly more dangerous

if we help the user to generate random key pairs, then the user can download the private key, this can prevent the publickey duplication, but the burden for the user will become heavy, they need to use special parameters each time to choose the gitpod privatekey

akosyakov · 2022-03-30T08:00:12Z

I would start with something simple like single ssh command with a warning about private keys. As a next step add SSH keys to improve on it. I am not sure about providing other options I would prefer to see users using the simple method, i.e. run some usability testing.

iQQBot · 2022-03-30T08:09:15Z

Who can help me write this warning text? Do we need to explain to the user why a default private key is needed? @akosyakov

#9003 (comment) I think these situations still need to be considered, if the user is a professional user that is no problem, but if the user is not a professional user they will be very confused

akosyakov · 2022-03-30T08:21:37Z

Who can help me write this warning text? Do we need to explain to the user why a default private key is needed? @akosyakov

I remember you mentioned also that ssh supports an option to use only password based auth without keys? i.e. will disabling of StrictHostKeyChecking help?

#9003 (comment) I think these situations still need to be considered, if the user is a professional user that is no problem, but if the user is not a professional user they will be very confused

I am not sure yet what our users are going to do with it. We could do later it too, no? We should get out something simple and run some usability tests.

iQQBot · 2022-03-30T08:41:37Z

I remember you mentioned also that ssh supports an option to use only password based auth without keys? i.e. will disabling of StrictHostKeyChecking help?

Yes, ssh supports password-only authentication, but the ssh command does not support passing passwords, which is the biggest problem, If you need to pass a password, you must use a tool like sshpass. StrictHostKeyChecking is used to skip the host fingerprint confirmation

akosyakov · 2022-03-30T09:00:38Z

Yes, ssh supports password-only authentication, but the ssh command does not support passing passwords, which is the biggest problem, If you need to pass a password, you must use a tool like sshpass. StrictHostKeyChecking is used to skip the host fingerprint confirmation

ok, could we then instead provide a warning which says that a user should have at least one private key and point to some docs how to create it (maybe there is some nice section on ssh.com)?

akosyakov · 2022-03-31T13:05:53Z

@iQQBot It worked nicely for me. 🙏 @gtsiolis Could you help with styling of dialog please?

components/dashboard/src/start/StartWorkspace.tsx

iQQBot · 2022-04-06T07:33:09Z

before we ship this, can you ensure to add an analytics tracking event? Ideally with a property that distinguishes between the usage on the dashboard and from the workspace loading/start page? 🙏

@loujaybee we already got this event by dashboard_clicked, we can distinguishes it by path

{"jsonrpc":"2.0","id":14,"method":"trackEvent","params":{"anonymousId":"da439578-2c6c-42f8-80bc-ae6bfa1ca450","event":"dashboard_clicked","properties":{"path":"/workspaces","label":"Actions","button_type":"primary"}}}

Do we need to add a separate analytics tracking event for this?

iQQBot · 2022-04-06T07:45:56Z

@gtsiolis I follow your suggestion, can you please have a look again?

akosyakov · 2022-04-06T08:35:10Z

@iQQBot new analytics events have to be added here: https://www.notion.so/gitpod/Tracking-Plan-ed27d1492da745b9b31711dd73dcbe57#6c68c725b7d744ebb0bd1593f37ed623

akosyakov · 2022-04-06T08:39:34Z

I think it is alright to reuse events if they are stable, but we have to update the epic to have proper info about how we can verify that a feature got discovered and used. It would be also cool to have a dashboard for it in Mixpanel. cc @loujaybee

iQQBot · 2022-04-06T09:37:52Z

I think we can reuse dashboard_clicked event, it can distinguishes between the usage on the dashboard and from the workspace loading/start page

loujaybee · 2022-04-06T10:39:30Z

/werft run

👍 started the job as gitpod-build-pd-ssh-copy.12

loujaybee · 2022-04-06T10:58:15Z

@iQQBot ah yep, I think that tracking event should work, thanks! 🚀

gtsiolis · 2022-04-06T13:02:24Z

fyi: Can not open new workspaces in the preview environment. Cross-posted internally, see relevant discussion (internal).

iQQBot · 2022-04-06T14:52:48Z

/werft run

👍 started the job as gitpod-build-pd-ssh-copy.15

gtsiolis · 2022-04-06T16:44:30Z

components/dashboard/src/workspaces/ConnectToSSHModal.tsx

+                <p className="text-gray-500 whitespace-normal text-base">
+                    The following shell command can be used to SSH into this workspace.
+                </p>


suggestion: What do you think of 🅰️ reordering the elements so that the modal description is closer to the text input and maybe 🅱️ introducing a primary action button for the modal for the same action to copy the command to clipboard? Going with just 🅰️ should suffice for now.

BEFORE AFTER (:a:) AFTER (:b:)

Sounds good! Impeccable agreements! 🤝

components/dashboard/src/workspaces/ConnectToSSHModal.tsx

gtsiolis

Looks great, @iQQBot! Left one last comment above.

iQQBot · 2022-04-06T19:00:27Z

@gtsiolis Already change, please take a look again

iQQBot · 2022-04-07T07:18:31Z

Can someone from @gitpod-io/engineering-webapp have a review?

gtsiolis

UX looks great, @iQQBot! Let's ship it! 🛹

mustard-mh · 2022-04-07T08:39:38Z

UX looks great, @iQQBot! Let's ship it! 🛹

Oooh, we need robot to cover related keywords to our notion define. XD

cc @gtsiolis

geropl

LGTM

iQQBot requested a review from a team March 29, 2022 15:14

roboquat added release-note size/L labels Mar 29, 2022

github-actions bot added the team: webapp Issue belongs to the WebApp team label Mar 29, 2022

gtsiolis requested a review from a team March 29, 2022 15:46

github-actions bot added the team: product-design label Mar 29, 2022

gtsiolis reviewed Mar 29, 2022

View reviewed changes

iQQBot closed this Mar 30, 2022

iQQBot force-pushed the pd/ssh-copy branch from a64e6d6 to 686a286 Compare March 30, 2022 14:28

roboquat added size/XS and removed size/L labels Mar 30, 2022

iQQBot reopened this Mar 30, 2022

roboquat added size/L and removed size/XS labels Mar 30, 2022

loujaybee added the team: IDE label Mar 30, 2022

iQQBot force-pushed the pd/ssh-copy branch from 4ddcb7c to f2f46a5 Compare March 30, 2022 15:35

akosyakov reviewed Mar 31, 2022

View reviewed changes

components/dashboard/src/start/StartWorkspace.tsx Show resolved Hide resolved

iQQBot dismissed gtsiolis’s stale review via 8212c57 April 6, 2022 07:36

iQQBot force-pushed the pd/ssh-copy branch from 3241f57 to 8212c57 Compare April 6, 2022 07:36

iQQBot force-pushed the pd/ssh-copy branch from 8212c57 to 9ada9c4 Compare April 6, 2022 13:09

loujaybee assigned iQQBot Apr 6, 2022

gtsiolis reviewed Apr 6, 2022

View reviewed changes

gtsiolis previously approved these changes Apr 6, 2022

View reviewed changes

[dashboard] support connect via SSH

dff58d0

iQQBot dismissed gtsiolis’s stale review via dff58d0 April 6, 2022 18:31

iQQBot force-pushed the pd/ssh-copy branch from 9ada9c4 to dff58d0 Compare April 6, 2022 18:31

gtsiolis approved these changes Apr 7, 2022

View reviewed changes

geropl self-assigned this Apr 8, 2022

geropl approved these changes Apr 8, 2022

View reviewed changes

roboquat merged commit 7a708ce into main Apr 8, 2022

roboquat deleted the pd/ssh-copy branch April 8, 2022 07:17

gtsiolis mentioned this pull request Apr 11, 2022

Introduce command palette action to connect to workspace via SSH #9230

Open

roboquat added deployed: webapp Meta team change is running in production deployed: IDE IDE change is running in production labels Apr 12, 2022

iQQBot mentioned this pull request Jun 6, 2022

Epic: Upload users SSH keys to Gitpod #9932

Closed

[dashboard] support connect via SSH #9003

[dashboard] support connect via SSH #9003

Conversation

iQQBot commented Mar 29, 2022 • edited

Description

Related Issue(s)

How to test

Release Notes

Documentation

iQQBot commented Mar 29, 2022

iQQBot commented Mar 29, 2022

gtsiolis commented Mar 29, 2022 • edited by werft-gitpod-dev-com bot

gtsiolis left a comment • edited

Choose a reason for hiding this comment

gtsiolis Mar 29, 2022

Choose a reason for hiding this comment

iQQBot Mar 29, 2022

Choose a reason for hiding this comment

csweichel Mar 29, 2022

Choose a reason for hiding this comment

iQQBot Mar 29, 2022

Choose a reason for hiding this comment

csweichel Mar 29, 2022

Choose a reason for hiding this comment

iQQBot commented Mar 29, 2022 • edited by werft-gitpod-dev-com bot

csweichel commented Mar 29, 2022 • edited by werft-gitpod-dev-com bot

iQQBot commented Mar 29, 2022 • edited by werft-gitpod-dev-com bot

akosyakov commented Mar 30, 2022

iQQBot commented Mar 30, 2022 • edited

akosyakov commented Mar 30, 2022 • edited

iQQBot commented Mar 30, 2022

akosyakov commented Mar 30, 2022

akosyakov commented Mar 31, 2022 • edited by werft-gitpod-dev-com bot

iQQBot commented Apr 6, 2022 • edited by werft-gitpod-dev-com bot

iQQBot commented Apr 6, 2022

akosyakov commented Apr 6, 2022

akosyakov commented Apr 6, 2022 • edited

iQQBot commented Apr 6, 2022

loujaybee commented Apr 6, 2022 • edited by werft-gitpod-dev-com bot

loujaybee commented Apr 6, 2022 • edited

gtsiolis commented Apr 6, 2022

iQQBot commented Apr 6, 2022 • edited by werft-gitpod-dev-com bot

gtsiolis Apr 6, 2022 • edited

Choose a reason for hiding this comment

iQQBot Apr 6, 2022

Choose a reason for hiding this comment

gtsiolis Apr 7, 2022

Choose a reason for hiding this comment

gtsiolis left a comment

Choose a reason for hiding this comment

iQQBot commented Apr 6, 2022

iQQBot commented Apr 7, 2022

gtsiolis left a comment

Choose a reason for hiding this comment

mustard-mh commented Apr 7, 2022 • edited

geropl left a comment

Choose a reason for hiding this comment

iQQBot commented Mar 29, 2022 •

edited

gtsiolis commented Mar 29, 2022 •

edited by werft-gitpod-dev-com bot

gtsiolis left a comment •

edited

iQQBot commented Mar 29, 2022 •

edited by werft-gitpod-dev-com bot

csweichel commented Mar 29, 2022 •

edited by werft-gitpod-dev-com bot

iQQBot commented Mar 29, 2022 •

edited by werft-gitpod-dev-com bot

iQQBot commented Mar 30, 2022 •

edited

akosyakov commented Mar 30, 2022 •

edited

akosyakov commented Mar 31, 2022 •

edited by werft-gitpod-dev-com bot

iQQBot commented Apr 6, 2022 •

edited by werft-gitpod-dev-com bot

akosyakov commented Apr 6, 2022 •

edited

loujaybee commented Apr 6, 2022 •

edited by werft-gitpod-dev-com bot

loujaybee commented Apr 6, 2022 •

edited

iQQBot commented Apr 6, 2022 •

edited by werft-gitpod-dev-com bot

gtsiolis Apr 6, 2022 •

edited

mustard-mh commented Apr 7, 2022 •

edited