Why not just use SSH?
Rtty – Access a device’s terminal from anywhere via the web
11–20 of 63 posts
Re: Rtty – Access a device’s terminal from anywhere via the web
#12Re: Rtty – Access a device’s terminal from anywhere via the web
#13Why not just use SSH?
because it's not hip anymore. This is for the beardy old unix guys who don't understand the whole new world in the clouds.
Re: Rtty – Access a device’s terminal from anywhere via the web
#14What could go wrong?
Haven't checked the code. Any obvious security flaws? Or is it the fact that it's not peer tested and proven?
The intended use of this is "maintaining" internet of things devices.
So it's not really meant to be a secure system, think of it as a botnet CnC and this makes a lot more sense.
It's why the system is supposed to be run on OpenWRT (which most cheap IOT things are based on), it why there's not hostnames, it's why it supports hundreds or thousands of devices.
Re: Rtty – Access a device’s terminal from anywhere via the web
#15Why not just use SSH?
Perhaps it has one S too many.
Re: Rtty – Access a device’s terminal from anywhere via the web
#16I‘m using ttyd (https://github.com/tsl0922/ttyd) behind an nginx reverse proxy with client certificates.
This gives me access from locations where ports other than https are blocked.
Re: Rtty – Access a device’s terminal from anywhere via the web
#17Earlier quoted context omitted.
Haven't checked the code. Any obvious security flaws? Or is it the fact that it's not peer tested and proven?
The intended use of this is "maintaining" internet of things devices. So it's not really meant to be a secure system, think of it as a botnet CnC and this makes a lot more sense. It's why the system is supposed to be run on OpenWRT (which most cheap IOT things are based on), it why there's not hostnames, it's why it supports hundreds or thousands of devices.
> The intended use of this is "maintaining" internet of things devices.
> So it's not really meant to be a secure system, think of it as a botnet CnC and this makes a lot more sense.
Is there anything to back this up? While the mtls initialization looks less than ideal and there's downright stupid stuff in the README like credentials in URI parameters, this doesn't look any different than the other web terminal gateways we've seen on HN over the last few weeks.
> which most cheap IOT things are based on
Most cheap IoT devices I'm aware of aren't remotely capable of running OpenWRT, do you happen to have examples for this?
Re: Rtty – Access a device’s terminal from anywhere via the web
#18[deleted]
Re: Rtty – Access a device’s terminal from anywhere via the web
#19> Access your device's terminal from anywhere via the web
Nah, nice try, but I'm good with ssh, key based authentication and few white-listed IPs.
Re: Rtty – Access a device’s terminal from anywhere via the web
#20This might be useful as a backdoor around networks with strict rules that block SSH access, until the network admins detect and block this as well. People got fired for installing tools like this, think twice before trying with your company's servers.