Log In [secure]
Log In [http]

Anyterm

A Terminal Anywhere

Configuration - 1.1 Branch

1. Specifying the command to run

By default Anyterm presents a shell running with the same uid as your web server, but you can run any program you like. You could directly run a text-mode application if you wanted (see the demo page for an example).

To specify the command to run, put an anyterm_command line in your Apache configuration, e.g. in your .htaccess file:

anyterm_command '/path/to/anygetty --remotehost "Anyterm: %h"' <Files anyterm-module> SetHandler anyterm </Files>

The command is run using "/bin/sh -c", so it can include input/output redirection and other shell features. You can also preceed the command with environment variable settings. This can be useful for adjusting the terminal type ("linux" by default) or locale. For example, "LANG=en_GB foo" runs foo with a British English locale.

1.1. Variable Expansions

Anyterm expands %h in the command to the hostname (or IP address) of the client (you need "HostnameLookups On" in your Apache configuration to get names rather than IP addresses; you can put this in a <Directory> section but not in a .htaccess file).

When the user is authenticated using HTTP_AUTH, %u gives their username. If they are not authenticated it expands to the empty string.

%p expands to an optional parameter passed from the HTML; see below. This is a potential secuirty hole: consider what happens if the user passes "`rm -rf /`"! You should not use this feature unless you have considered the security implications.

Other expansions could be added in the future. If you need a literal % in the command, write %%.

2. Logging In with anygetty

If you want to present a login: prompt you need something that does what /sbin/getty and /bin/login do for real logins. anygetty is a small C program based on mingetty that tries to do this; it should present the same interface and environment as a real console login. To compile it, just "make" in the anygetty directory.

There are some permissions complications with anygetty and /bin/login. anygetty needs to write to utmp, and /bin/login needs to run as root. On some systems /bin/login is setuid root, but on others it is not.

If your /bin/login is setuid root:
You just need to make sure that anygetty can write to utmp. It's probably best to do this by adding the user that anygetty runs as (probably www-data) to the group owning utmp (probably utmp). Note that you need to restart Apache after changing its group membership.
If your /bin/login is not setuid root:
Your choice is either to make /bin/login setuid root and then make utmp writable by anygetty, as above, or to leave /bin/login alone and to make anygetty setuid root. I'm not sure which is better from the security point of view. Do please think about the security implications before doing any of this.

If you haven't go this right you might get the message No utmp entry. You must exec "login" from the lowest level "sh" after entering your username.

Some systems, including Gentoo, have a version of /bin/login that calls vhangup(). Check your login man page. This does not work with anygetty; the symptom may be that anygetty hangs after you have entered your username, or you get an error about not being able to set permissions on the TTY. I would welcome advice about a possible work-around; it is likely that simply removing the call to vhangup would be sufficient to make it work.

Also, some systems have a version of /bin/login that hangs around after the user's shell has started so that it can do PAM-related termination things later. This can also cause complications. If you are having trouble getting anygetty to work please check in the forums as there is a good chance that someone else has been solving the same problems.

If you're using a system with SE-Linux security features, such as Fedora Core 3, you may find that they further complicate things. The contrib directory in the distribution contains configuration files that should enable anygetty on those platforms.

In principle the HTTP_AUTH username could be passed to anygetty's autologin function using '--autologin %u' (see above). The permissions issues to get this working have not yet been resolved.

3. ssh to localhost

An alternative to anygetty that could prove simpler to get working is to ssh (or telnet or rlogin) to locahost:

anyterm_command '/usr/bin/ssh %u@localhost'

This has the disadvantage that there are more processes involved, as well as an extra layer of encryption/decryption if you use ssh rather than telnet or rlogin. But it could be worth considering if you are finding the permissions issues with anygetty hard to get right.

4. Character Sets

From version 1.1.16, Anyterm supports multiple character sets. By default, ASCII is used and any non-ASCII characters are removed.

To set a different character set, edit your anyterm.html file and specify the character set as the last parameter to the create_term function call (see below).

The character set must be supported by iconv. To see a list of the character sets that iconv supports, and how it spells them, run "iconv -l". Furthermore, it probably needs to be a character set in which the basic ASCII characters and control codes have the same values as in ASCII. ISO-8859-* and UTF-8 certainly work; feedback about other character sets would be appreciated.

Of course you need to set up your environment so that the programs you run inside Anyterm know what character set to use. See the notes above about setting environment variables.

This functionality is quite new, and your questions and feedback are welcome in the forum.

5. Customising the HTML & CSS

It's quite easy to customise the HTML, so that your page can contain content other than the terminal, and so on. Use anyterm.html as a template. You need to load the anyterm.js script in the header. At the point on the page where you want the terminal to appear, place a <div> with an id attribute:

<div id="term"></div>

To open the terminal, call the create_term function. anyterm.html does this from the window.onload handler, so the terminal is opened as soon as the page is loaded (below), but you can equally well call it from a button or some other code.

<script type="text/javascript"> window.onload=function() {create_term("term","%h (Anyterm%v)",25,80);}; </script>

The parameters to create_term are:

At some point in the future it may become possible to create multiple terminals with multiple create_term calls, but for now there must only be one.

You can also use CSS to change the appearance of the terminal, including the colour scheme. See anyterm.css for examples.

6. Other Settings

The screen-to-screen difference algorithm can also be tweaked by adjusting parameters towards the end of common/diff.cc.