# \[ANNOUNCE\]node-red-contrib-xterm : second beta (sidebar)

**URL:** <https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718>\
**Category:** Share Your Nodes\
**Created:** [30 December 2019 00:16 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718 "2019-12-30T00:16:47Z")\
**Posts on this page:** 20\
**Page:** 5

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [7 January 2020 11:12 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/82 "2020-01-07T11:12:16Z")

</div>

Hey Paul,  
yes I have added the permissions because (in the above discussion) my endpoint was not secured. So it should be there!!!!!! But I don't know why this is a problem for you, and not for the others 🥴

[EDIT] From the [documentation](https://github.com/node-red/cookbook.nodered.org/wiki/Create-an-admin-configuration-API-endpoint) I see this:

> the `needsPermission` middleware is there to ensure only authenticated users can access the endpoint. The permission should be of the form `<node-type>.read`

Is there perhaps anything special about your security ?

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [7 January 2020 11:56 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/83 "2020-01-07T11:56:04Z")

</div>

> [@BartButenaers](#):
>
> Is there perhaps anything special about your security ?

No, nothing special, script installed node-RED is setup as per the guide, and the only software running on the Pi is node-RED, Mosquitto, UFW & Certbot. It was a completely new installation made about 3 or 4 weeks ago.

Node-RED version: v1.0.3  
Node.js version: v12.14.0  
Linux 4.19.75-v7+ arm LE (Buster)  
Raspberry Pi 3b+

Node-RED settings  
`credentialSecret` added to encrypt credentials  
`adminAuth` added to password protect the Node-RED editor and admin API  
`httpNodeAuth` added to protect the node-defined HTTP endpoints  
`https:` added to serve node-RED via https  
`requireHttps: true,` to redirect http connections

In addition, I use UFW to restrict certain port access to defined IP addresses (ie only allow MQTT port access from my remote servers).

---

<div class="post-metadata">

**Author:** ![edorgeville](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/edorgeville/32/8588_2.png) [@edorgeville](https://discourse.nodered.org/u/edorgeville)\
**Post date:** [7 January 2020 14:35 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/84 "2020-01-07T14:35:03Z")

</div>

Hi @BartButenaers,  
Great work on the node. I will be testing it soon.  
I haven't looked at the source yet, do you think your work could be ported to make a dashboard widget?  
One of the use case I have would be to give a user access to an interactive CLI tool.  
Thanks!

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [7 January 2020 20:59 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/85 "2020-01-07T20:59:15Z")

</div>

> [@edorgeville](#):
>
> your work could be ported to make a dashboard widget

Hi Erwin (@edorgeville),  
Although it might seem very similar, there are a lot of changes required:

- Dashboard UI node instead of sidebar panel.
- AngularJs instead of jQuery
- RED.httpNode instead of RED.httpAdmin node.
- Flow editor and dashboard use other websocket libraries
- Since the RED.httpNode [doesn't](https://discourse.nodered.org/t/red-httpnode-get-gives-unauthorized/8749/2) accept RED.auth.needsPermission, I'm not sure how secure it is? Might be no problem, but I don't know ...
- Currently the sidebar panel ensures that always a single Terminal config node exists. Not clear to me how you would manage the terminal settings in a UI node (since you don't have a sidebar tabsheet then).
- And so on ...

Of course everything is possible, but at first sight it probably needs to be build from scratch...  
But you have the advantage that you can start from my current code. Good luck with it!

Bart

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [7 January 2020 21:17 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/86 "2020-01-07T21:17:40Z")

</div>

> [@Paul-Reed](#):
>
> No, but I again installed the node this morning, and got exactly the same error,

Paul (@Paul-Reed) ,  
Not sure at the moment where to start searching for the cause ...  
If anybody has tips, be my guest!!

When I navigate manually to my admin endpoint (https://\_\_:1880/xterm\_shell/static/xterm.js), then I get a popup to enter my credentials:

![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/2X/5/5ba786725d958d1dfd8abcb652dd448091653e02.png)

Once I have entered my credentials, the xterm.js file will be loaded and displayed.  
Does it behave the same way in your setup?

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [7 January 2020 21:31 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/87 "2020-01-07T21:31:36Z")

</div>

> [@BartButenaers](#):
>
> Does it behave the same way in your setup?

I get the sign-in dialogue, enter my credentials, and then the browser message is;  
`Cannot GET /xterm_shell/static/xterm.js`

and the browser console error;

![xterm](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/2X/9/99f5dc088b945b0663cb68f4aa68a65f6b8620d0.jpeg)

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [7 January 2020 22:05 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/88 "2020-01-07T22:05:21Z")

</div>

Paul, apologies the URL should be _https://\_\_\_:1880/xterm/xxxx/static/xterm.js_  
The "xxxx" is normally your (unique) terminal id, which is not relevant for getting the static files ...

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [7 January 2020 22:16 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/89 "2020-01-07T22:16:16Z")

</div>

> [@BartButenaers](#):
>
> The "xxxx" is normally your (unique) terminal id, which is not relevant for getting the static files ..

🤔 I don't understand your last post. Do you want me to try another URL? or any other information.

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [7 January 2020 22:17 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/90 "2020-01-07T22:17:32Z")

</div>

Ah yes, just try _https://\_\_\_:1880/xterm/xxxx/static/xterm.js_  
Forget the other stuff I wrote

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [7 January 2020 22:22 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/91 "2020-01-07T22:22:20Z")

</div>

> [@BartButenaers](#):
>
> just try _https://\_\_\_:1880/xterm/xxxx/static/xterm.js_

`Cannot GET /xterm/xxxx/static/xterm.js`

What is & where do I get the xxxx (terminal id)?

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [7 January 2020 22:33 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/92 "2020-01-07T22:33:16Z")

</div>

OMG Paul, I'm getting nuts ... 🙄 🥴

The url is https://\_\_\_:1880/xterm\_shell/xxxx/static/xterm.js

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [7 January 2020 22:35 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/93 "2020-01-07T22:35:54Z")

</div>

That results in no request for credentials and;  
`Unauthorized`

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [7 January 2020 22:37 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/94 "2020-01-07T22:37:13Z")

</div>

No credentials popup? And if you try in an incognito window?

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [7 January 2020 22:38 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/95 "2020-01-07T22:38:59Z")

</div>

Yes, that's what I'm working from. (a different one with each change!)

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [7 January 2020 22:45 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/96 "2020-01-07T22:45:00Z")

</div>

_ **Ok, then I really need some help from the community to get this last issue solved...** _

My endpoint looks like this:

```auto
RED.httpAdmin.get('/xterm_shell/:terminal_id/:command/:info', RED.auth.needsPermission('xterm.write'), function(req, res) {

```

So when you manually enter an url like `https://___:1880/xterm_shell/xxxx/static/xterm.js`, the url pattern should match to my endpoint. While a get nicely a credentials popup, you simply get **UnAuthorized**.

And when you remove the `RED.auth.needsPermission('xterm.write')` then it works fine for you. But when you replace it by `RED.auth.needsPermission('xterm.read')` then it also fails.

Don't know at the moment why it fails. And my time is up for today ...

[EDIT] here is a similar [case](https://stackoverflow.com/questions/41567175/send-data-on-configuration), but don't understand the explanation because it works here fine on my pc ...

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [7 January 2020 22:54 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/97 "2020-01-07T22:54:45Z")

</div>

This is a really good addition to the node-RED arsenal, as it allows access to the cli remotely.  
So when away from home, so long as node-RED is running, we can make cli changes - updates, fix's, reboots, etc, etc.  
Maybe @knolleary or @dceejay would be kind enough to maybe cast their eye upon this, which is summarized by Bart's last post.

---

<div class="post-metadata">

**Author:** ![afelix](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/afelix/32/9743_2.png) [@afelix](https://discourse.nodered.org/u/afelix)\
**Post date:** [8 January 2020 17:05 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/98 "2020-01-08T17:05:57Z")

</div>

Paul, to answer your location question: When you start a regular terminal window it starts in the home directory of the user. The reason it starts in the User Directory set for Node-RED is because that's where Node-RED itself starts too. By starting the nodeJS process it (simplified, don't quote me on this for other usages) sets the current working directory (also named `cwd` sometimes but called as `pwd` because of the Present Working Directory) to the folder it starts in, which is the User Directory. Because of this node-red is able to access the node\_modules folder in that place, as well as other relevant files needed to execute.

TL;DR: regular user has the `~` home directory set as the path it starts the terminal from, starting it from Node-RED uses the current working directory node-RED has aka the `.node-red` folder by default (or any other folder set as user directory).

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [10 January 2020 14:56 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/99 "2020-01-10T14:56:58Z")

</div>

> [@Paul-Reed](#):
>
> ...would be kind enough to maybe cast their eye upon this

@BartButenaers _"...and I asked so politely"_ 😉

Never mind, I'll just keep my local edited copy for now, and let's see if others report problems when you npm publish the node.

Paul

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [12 January 2020 19:29 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/100 "2020-01-12T19:29:47Z")

</div>

Hi guys,  
There is a new version on Github with following changes:

- Fix for Paul Reed's unauthorized issue.
- All requests are now POST's instead of GET's.
- The readme page now contains a link to SSH explanation above (thanks to @zenofmud) .

This is hopefully the last beta.  
Will publish it on NPM by the end of this month, since I will have surgery this week...  
If there are any issues with the new version, please post them here and I will respond as soon as possible.

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [18 January 2020 20:34 UTC](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718/101 "2020-01-18T20:34:43Z")

</div>

Hi @BartButenaers I realize that you are probably not around at the moment, but I'll leave this here for you to pick up whenever you are back.

I think that there is another auth bug!  
For the first time I've just tried the xterm `Terminal input` node, and it's not working for me.  
If I add a command to the node config & deploy, upon injecting the node, I get a request to sign in.  
I enter my username & password, but it is not accepted, and I get a further request to sign in, and so on.

Checking the browser console, I see;

 ![error](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/c/7/c77324b19636d36bc1a7c04631ae07dcf6f7666a.jpeg)  
As I recall, I seem to be getting these auth errors (whilst others don't 🤨) because I have enabled `adminAuth` in my node-RED settings.

[Previous page](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718.md?page=4)

[Next page](https://discourse.nodered.org/t/announce-node-red-contrib-xterm-second-beta-sidebar/19718.md?page=6)