FileSystemProvider: no way of handling permissions issues

Refs: https://github.com/Microsoft/vscode/issues/48421
Setup:

clone https://github.com/bpasero/remote-fs
F5
click "Refresh" in the explorer
you should see the current working directory as a remote folder using the file system provider for scheme datei://

I can think of 2 reasons why a permission error raises:

user needs elevated rights to change a file or folder
a file can be readonly (e.g. Windows) and to save it you need to first remove the readonly flag

Currently there does not seem to be a way to signal a) to save as elevated user or b) to remove the readonly flag.
I am not sure how relevant this is for any other file system provider that does not have these concepts but this is something our file service can do (via the options overwriteReadonly and writeElevated).

I am not sure how relevant this is for any other file system provider that does not have these concepts but this is something our file service can do

Unsure, permissions and ownership is a common concept but I don't know how VS Code handles that...

@jrieken the file service can return either FILE_READ_ONLY or FILE_PERMISSION_DENIED as FileOperationResult and this will surface as a notification in the UI to ask to either overwrite (the readonly one) or save as admin for the other one. If the user agrees, either overwriteReadonly or writeElevated will be set to true the next time we update the content.
I guess we would need to have similar options for the API but I am not sure how you would even possibly implement at least the writeElevated one.

I pushed https://github.com/Microsoft/vscode/commit/4cce7c0743f61e46f87425046cb656e5388f7d72 to be able to preserve the "Overwrite readonly" behavior with the new file system provider. This currently hardcodes a check for file:// scheme. I think that is fine for now and I will need to do the same for saving elevated.

I've been looking the github issues and different discussions but I wasn't able to find a proper answer. As this is the closest issue to my question I though about asking here.
When implementing a FileSystemProvider (for example to a remote repository), can you set the editor as read-only based on the document/file permissions (for instance if the document is locked by another user)?
If not is there an API to set the editor as readOnly more generally, that I could make use of?

@plus- this is currently not possible on a per-file basis, see https://github.com/microsoft/vscode/issues/73122 for relevant feature request.

Would this address the scenario mentioned here:
https://github.com/microsoft/vscode-remote-release/issues/390#issuecomment-496233469

I was very excited to discover SSH-Remote in vscode, thinking it could replace my (limited) vi skills. But, like the OP, I need to be able to sudo to change config files in places like /etc. The audience for this feature is admins who are not necessarily coders. For these kinds of users, who are administering production systems, the option of enabling root is a non-starter. I hope the vscode team finds a way to implement the ability to sudo remotely. That would make the system a killer remote admin environment.

@yobyot Until something is implemented the terminal works with SSH-Remote. So you can edit a file then save it anywhere on the server and sudo mv it in the terminal without switching windows.

I came here for the exact same use case as @TrevorSayre (https://github.com/microsoft/vscode-remote-release/issues/390)

I am mainly wanting this so I can edit files in /etc/nginx

It would be so damn helpful to use Vscode to remotely do some configuration on my servers!! Currently this is only possible with Atom, unfortunately..

I was so excited to use this remote development extension with vscode but now seeing I can't edit any files the require permission elevation I was very disappointed...

Failed to save 'example.com': Unable to write file (NoPermissions (FileSystemError): Error: EACCES: permission denied, open '/etc/nginx/sites-available/example.com')

There must be some way to make it work.  For example, I use this workaround with WinSCP when I want to work with elevated permissions but it doesn't work with vcscode:
user_name ALL=(ALL) NOPASSWD: /usr/lib/openssh/sftp-server
Then in WinSCP there is an option for it to execute a custom command prefixed with sudo like:
sudo /usr/lib/openssh/sftp-server
This allows WinSCP to automatically be able to write to any file without ever having to use any passwords while you have the file under /etc/sudoers.d with the NOPASSWD directive in place.  I gladly trade security temporarily for this convenience as it's easy enough to comment out that directive when you don't need it.
How can this be done with vscode and the remote-ssh-development extension?  Does it use sftp-server or something else and can you add sudo in front of whatever command vscode executes on the local machine to connect to the remote?
Thank you.

I also need this feature to edit config files under /etc/...

@bpasero Obviously there is a lot of demand regarding this issue

Going to chime in that I need it also for making changes to WP PHP files. Since the user and group is www-data
Wanted to give another use case for this.

I just got the idea to use VSCode for viewing/editing Apache2 config files on our team's Jenkins server... but I ran into this issue pretty quickly.
I thought I might have a workaround by using the -t option in the ssh command line, and specify sudo bash as the command to use (hostname is redacted):

Open-ended support for any command-line option seems to be implied by the example text in the textbox ssh<EMAIL_ADDRESS>-A. Sadly, it appears not -- the file permissions issue still appears when connecting this way.

Not able to edit library source in remote due to this issue, for ex: files under /usr/lib/python3/dist-packages/

Please add the feature and solve this, I was having trouble in editing files in aws instances. The user I ssh into is ec2-user but that doesn't give any perm to edit files having a high permission setting.

Regarding problem (b) I don't think that the FS API is the right way to go. You probably don't want to solve this on a per-file basis, but to work on the remote machine under a different user than the one you used to login. So you want to call 'su -' or 'sudo -u apache -i' directly after ssh login. This is already possible! You can do that with a RemoteCommand in the ssh config:
Host foo
  HostName foo
  RemoteCommand sudo -u apache -i

The RemoteCommand was added to OpenSSH in 2017 and I can confirm that it works on macOS Catalina, even though vim's syntax highlighting doesn't recognize it, yet.

it seems like it should be part of the ssh setup as @thorstenhirsch mentions

This is already possible! You can do that with a RemoteCommand in the ssh config:
Host foo
  HostName foo
  RemoteCommand sudo -u apache -i

It works when I try it directly in the command line but seems to be skipped when entered in the config file. @thorstenhirsch when you say it work do you mean from the command line or through the vscode connection?

Per the logs when configuring this, what reaches the ssh client is something like
[14:00:52.230] Running script with connection command: "C:\Program Files\Git\usr\bin\ssh.exe" -T -D 63356 -o RemoteCommand=none <remotehost> bash

So either there is something which actively Nulls the RemoteCommand or their needs to be some tweaking.

Yes, I'm sorry, my test was flawed. It really doesn't work due to -o RemoteCommand=none, which is a hard-coded parameter in the remote-ssh extension. I removed it (in the extension's extension.js) to see what happens:

macOS client, ArchLinux server, w/o RemoteCommand: connection works
macOS client, ArchLinux server, RemoteCommand sudo su -: could not establish ssh connection
Win7 client, RHEL7 server, w/o RemoteCommand: error, something like "tried to write to a non-existent channel"
Win7 client, RHEL7 server, RemoteCommand sudo -u some_user -i: error, something like "tried to write to a non-existent channel"

Guess that's the reason why they're using -o RemoteCommand=none.

VS Code already supports "Save as admin" for local files, why not to support it in the same way for remote?

VS Code already supports "Save as admin" for local files, why not to support it in the same way for remote?

Couldn’t agree more
👍👍👍

Just found out about VSCode Remote Extensions today.
After a few hours of tinkering, i tried doing sudo code /etc/nginx/nginx.conf and obviously it didn't work. Which brought me here. I hope this can be implemented in the future. VS Code would be sooo useful for admins who already use VS Code for other stuff.

I'm also desperate about this ability. It's especially good working in VS text editor when you work with huge config files. I tried going the long route of adding my user to every group (www-data, root, etc.) that owns the config files, and giving that group also write permissions everywhere I need it. Trouble is that even after a reload the user is not part of those new groups. I have lost almost a day on this, and groups can be implemented only after you delete everything (vscode related) on the server, and reinstall again, which is a pain in the a..

I did some more experimenting and I've found a way that works. -o RemoteCommand=none is not the only thing in this extension that prevents VS Code from establishing a working ssh session after calling sudo -u newuser -i, we also need to remove bash so that VS Code does not start an additional shell session on the remote host.
Here's a HOWTO:

make sure that sudo -u newuser -i works in a regular ssh session without requesting a password
remove  "-o RemoteCommand=none" and "bash" from extension.js like so

sed -i s/"-o RemoteCommand=none"/""/ ~/.vscode/extensions/ms-vscode-remote.remote-ssh-*/out/extension.js
sed -i s/"bash"/""/ ~/.vscode/extensions/ms-vscode-remote.remote-ssh-*/out/extension.js

create an ssh config entry with a RemoteCommand like this one:

Host pi-for-newuser
  Hostname pi
  User pi
  RemoteCommand sudo -u newuser -i

This has been tested successfully with the following setups:

macOS 10.15.2 with VS Code 1.41.1/remote-ssh 0.48.0 to Raspbian (stretch)
Arch Linux with VS Code 1.38.1/remote-ssh 0.47.2 to Raspbian (stretch)

This of course is a workaround only. I hope the developers of this extension find a way to incorporate the necessary changes without breaking ssh remote connectivity for other systems.

I've ended here due to the problems already mentioned.
In my case I'm trying to change files located in /etc/ what requires sudo.
@thorstenhirsch thanks for the workaround instructions!

I hope the developers of this extension find a way to incorporate the necessary changes without breaking ssh remote connectivity for other systems.

I hope the same – apparently many people need this

I did some more experimenting and I've found a way that works. -o RemoteCommand=none is not the only thing in this extension that prevents VS Code from establishing a working ssh session after calling sudo -u newuser -i, we also need to remove bash so that VS Code does not start an additional shell session on the remote host.
Here's a HOWTO:

make sure that sudo -u newuser -i works in a regular ssh session without requesting a password
remove  "-o RemoteCommand=none" and "bash" from extension.js like so

sed -i s/"-o RemoteCommand=none"/""/ ~/.vscode/extensions/ms-vscode-remote.remote-ssh-*/out/extension.js
sed -i s/"bash"/""/ ~/.vscode/extensions/ms-vscode-remote.remote-ssh-*/out/extension.js

create an ssh config entry with a RemoteCommand like this one:

Host pi-for-newuser
  Hostname pi
  User pi
  RemoteCommand sudo -u newuser -i

This has been tested successfully with the following setups:

macOS 10.15.2 with VS Code 1.41.1/remote-ssh 0.48.0 to Raspbian (stretch)
Arch Linux with VS Code 1.38.1/remote-ssh 0.47.2 to Raspbian (stretch)

This of course is a workaround only. I hope the developers of this extension find a way to incorporate the necessary changes without breaking ssh remote connectivity for other systems.

Works like a charm. Thank you very much! @thorstenhirsch

For the latest version, we should do the following sed commands:
sed -i -e s/"-o[^=]*RemoteCommand=none"/""/ ~/.vscode/extensions/ms-vscode-remote.remote-ssh-*/out/extension.js
sed -i -e s/"bash"/""/ ~/.vscode/extensions/ms-vscode-remote.remote-ssh-*/out/extension.js

Thank you for sharing @thorstenhirsch.  Works perfectly.  Made my day!

I did some more experimenting and I've found a way that works. -o RemoteCommand=none is not the only thing in this extension that prevents VS Code from establishing a working ssh session after calling sudo -u newuser -i, we also need to remove bash so that VS Code does not start an additional shell session on the remote host.
Here's a HOWTO:
1. make sure that `sudo -u newuser -i` works in a regular ssh session without requesting a password

2. remove  `"-o RemoteCommand=none"` and `"bash"` from `extension.js` like so

sed -i s/"-o RemoteCommand=none"/""/ ~/.vscode/extensions/ms-vscode-remote.remote-ssh-*/out/extension.js
sed -i s/"bash"/""/ ~/.vscode/extensions/ms-vscode-remote.remote-ssh-*/out/extension.js

1. create an ssh config entry with a RemoteCommand like this one:

Host pi-for-newuser
  Hostname pi
  User pi
  RemoteCommand sudo -u newuser -i

This has been tested successfully with the following setups:
* macOS 10.15.2 with VS Code 1.41.1/remote-ssh 0.48.0 to Raspbian (stretch)

* Arch Linux with VS Code 1.38.1/remote-ssh 0.47.2 to Raspbian (stretch)

This of course is a workaround only. I hope the developers of this extension find a way to incorporate the necessary changes without breaking ssh remote connectivity for other systems.

Nice solution but sadly not for me. For security reasons sudo should always ask for a password.

@mjmucha You're right. This feature needs to be properly implemented.

Another user coming up against this problem trying to edit configs in /etc/
Like @mjmucha I'm also in an environment where sudo will always ask for a password so the workaround above won't work for me :(

I did some more experimenting and I've found a way that works. -o RemoteCommand=none is not the only thing in this extension that prevents VS Code from establishing a working ssh session after calling sudo -u newuser -i, we also need to remove bash so that VS Code does not start an additional shell session on the remote host.
Here's a HOWTO:

make sure that sudo -u newuser -i works in a regular ssh session without requesting a password
remove  "-o RemoteCommand=none" and "bash" from extension.js like so

sed -i s/"-o RemoteCommand=none"/""/ ~/.vscode/extensions/ms-vscode-remote.remote-ssh-*/out/extension.js
sed -i s/"bash"/""/ ~/.vscode/extensions/ms-vscode-remote.remote-ssh-*/out/extension.js

create an ssh config entry with a RemoteCommand like this one:

Host pi-for-newuser
  Hostname pi
  User pi
  RemoteCommand sudo -u newuser -i

This has been tested successfully with the following setups:

macOS 10.15.2 with VS Code 1.41.1/remote-ssh 0.48.0 to Raspbian (stretch)
Arch Linux with VS Code 1.38.1/remote-ssh 0.47.2 to Raspbian (stretch)

This of course is a workaround only. I hope the developers of this extension find a way to incorporate the necessary changes without breaking ssh remote connectivity for other systems.

I couldn't undertand the ssh host config
let's say I have 2 users on my server

root (obviously)
testuser

should my ssh host config look like this?
Host someServer   Hostname someServer.com   User testuser   RemoteCommand sudo -u testuser -i
or
Host someServer   Hostname someServer.com   User testuser   RemoteCommand sudo -u somedummyuser -i
or
Host someServer   Hostname someServer.com   User root   RemoteCommand sudo -u testuser -i

I solved it using ProxyJump.
Host my_host
  HostName my-host.net
  User my_user

Host my_host_as_other_user
  HostName localhost
  User other_user
  ProxyJump my_host

other_user is the one I wanted to sudo with. Now I can connect to my_host_as_other_user with VS Code ☺ .

is there a option to get this work on windows? now the workaround gives:
RemoteCommand sudo -u some_user -i: error, something like "tried to write to a non-existent channel"

@tiktuk Please correct me if I'm misunderstanding, but your workaround requires the remote host to have a superuser with access to the files in question - so it's not just the proxyjump trick, one also needs to change ownership/permissions on the remote?
(If true, on most production systems that wouldn't be allowed... We still need a good sudo elevation technique via vscode.)

@tiktuk Please correct me if I'm misunderstanding, but your workaround requires the remote host to have a superuser with access to the files in question - so it's not just the proxyjump trick, one also needs to change ownership/permissions on the remote?

That is correct, yes. In my case that other user had the required permissions already but that is not necessarily true of course. A way to sudo would still be useful.

Thank you very much, @thorstenhirsch. The workaround is very useful.
FYI: for the latest version, we should do the following sed commands:
sed -i -e s/"-o[^=]*RemoteCommand=none"/""/ ~/.vscode/extensions/ms-vscode-remote.remote-ssh-*/out/extension.js
sed -i -e s/"bash"/""/ ~/.vscode/extensions/ms-vscode-remote.remote-ssh-*/out/extension.js

Thank you very much, @thorstenhirsch. The workaround is very useful.
FYI: for the latest version, we should do the following sed commands:
sed -i -e s/"-o[^=]*RemoteCommand=none"/""/ ~/.vscode/extensions/ms-vscode-remote.remote-ssh-*/out/extension.js
sed -i -e s/"bash"/""/ ~/.vscode/extensions/ms-vscode-remote.remote-ssh-*/out/extension.js

The commands seem to still work, but after the most recent update of VSC this doesn't seem to be working for me anymore. Anybody else experiencing the same? Running Version: 1.44.2.

@robdejonge I can still confirm my commands work with VSCode 1.44.2, ms-vscode-remote.remote-ssh-0.51.0, and ms-vscode-remote.remote-ssh-edit-0.51.0 on MacOS.
(If you update the extensions, you need to run my commands again.)

@robdejonge I can still confirm my commands work with VSCode 1.44.2, ms-vscode-remote.remote-ssh-0.51.0, and ms-vscode-remote.remote-ssh-edit-0.51.0 on MacOS.
(If you update the extensions, you need to run my commands again.)

Thanks for confirming. Must be a local issue then. I've re-run the commands, but it still asks me for a root password when I try to log in. On any server, for that matter. I had only discovered this hack recently, I guess I'll go back to vi for the time being! :)

@robdejonge It's failing for me in 1.45.0. The sed commands work and successfully update the config, but vscode fails to execute a command with elevated permissions during the ssh session (Such as editing a config in /etc/nginx, which is not owned by my login user)

As a quick follow up to my comment, I was able to create a workaround in my development environment, by adding my login user to an ACL to my needed folders.
For example setfacl -m u:ec2-user:rwx /etc/nginx/*
This maintains ownership of the folder to it's original owner, but grants access to editing of files within a supplied directory.
Two thoughts:

I wouldn't do this in a production environment, especially on sensitive configuration files
You'll need to confirm your environment supports File-based Access Control Lists.

@robdejonge It's failing for me in 1.45.0. The sed commands work and successfully update the config, but vscode fails to execute a command with elevated permissions during the ssh session (Such as editing a config in /etc/nginx, which is not owned by my login user)

fails for me too. I'm working on Windows 10, VS Code 1.45.0
@webdog your workaround worked for me, and also taught me something new. thanks! :)

Quite amazed that this is not working !

The other obvious workaround is just to edit in the terminal with sudo vim myFile.... 😀 It's not that bad even though a VS Code editor window would be better....

I've found a workaround that seems to be working in my use case, without having to patch the VS Code files.
The issue I run into is trying to edit files owned by root, and in my case as in many others', direct  SSH to root is not allowed... so what I've done is
I've added a new entry to my ~/.ssh/config file
### Try workaround to use vscode as root
Host devbox-code
	Hostname devbox.domain.com
	AddKeysToAgent yes
	User		ubuntu
	ForwardAgent no
	IdentityFile ~/.ssh/my-keypair-for-devbox
	RemoteCommand sudo -u root -i

And when I use devbox-code as the remote host to connect to in VS Code Remote-SSH, I get a working VS Editor with root context; I've tested and I can open, close write etc files that are owned by root fine.
I'm running Remote-SSH 0.51.0 and VS Code Version: 1.46.1

As a workaround, I use sudoedit and the terminal:
export SUDO_EDITOR="code-insiders --wait"
sudoedit /etc/hostname

This will open /etc/hostname in vscode. It will only save the content when the vscode tab containing hostname is closed though (that's how sudoedit works). This should work on Linux, under SSH, and probably on MacOS too.

None of the workarounds worked for me except this
RemoteCommand sudo -u root -i
worked flawlessly!
Remote-SSH v0.51.0
VSCode 1.47.2

I had been trying all of the methods suggested above (RemoteCommand or ProxyJump etc) but none worked for me but finally the most simplest solution worked (or atleast in my use case + Public key based auth). I wanted to be able to edit any file on the remote host (through VSCode) which all are pretty much root owned.
Workaround:
Nothing changed on VSCode or extension side and login to remote host with normal user BUT added sudo su command under my user's bashrc  on target host which did the trick and i am able to edit and save files.
Note: Obviously the terminal switches to root with this but in case you wish to work under your own/normal user in terminal then just do:
sudo -u normal_user -i
exit
This does not effect the elevated rights for file editing/saving.

A workaround I'm using sometimes is to set ACL on the files I need to change often like this:
# on remote server:
sudo setfacl -Rm u:USERNAME:rwX,d:u:USERNAME:rwX /etc/icinga2

This sets write rights via ACL to /etc/icinga and all child items. You may than write all files in it.
Attention: As writing than doesn't need sudo or other procedure anymore, you should use this way carefully!

So I was to resolve this issue by adding to the config file only and nothing else
Read more about SSH config files: https://linux.die.net/man/5/ssh_config
Host alias-xx.x.x.x
    HostName xxx.xxx.xx.xx
    User root
    RemoteCommand sudo su

And that is it !!! it works perfectly well
I am using the latest version of Vscode as at this comment and

Of cause this works. You are using user root for login, which is mostly disabled. Not a recommended solution. I assume your RemoteCommand is not needed.

Of cause this works. You are using user root for login, which is mostly disabled. Not a recommended solution. I assume your RemoteCommand is not needed.

Sorry Any User Not root forgot to change that as well so you try it is works

So I was to resolve this issue by adding to the config file only and nothing else
Host alias-xx.x.x.x
    HostName xxx.xxx.xx.xx
    User anyUser
    RemoteCommand sudo su

And that is it !!! it works perfectly well
I am using the latest version of Vscode as at this comment and

Are you sure that you tried with any user other than root? As far as i have understood, the extension itself does not allow or execute RemoteCommand at all.

Hi,
i recently installed the Remote SSH extension and i am facing issue while renaming or creating new files in folder which has root as the owner. Kindly someone let me know the workaround in detail as there are many workarounds mentioned above and i dont understand which one to follow as well as they are not in detail.
Version: 1.47.3 (user setup)
Commit: 91899dcef7b8110878ea59626991a18c8a6a1b3e
Date: 2020-07-23T13:12:49.994Z
Electron: 7.3.2
Chrome: 78.0.3904.130
Node.js: 12.8.1
V8: 7.8.279.23-electron.0
OS: Windows_NT x64 10.0.18363
I am trying the remote session to a Lubuntu Machine.
Thanks in advance.

the fix is too easy, conect with your sudo user using ssh, go to file folder and run comand
sudo chmod 777 yourFile
and that it's i used to edit default file of nginx in aws vps

the fix is too easy, conect with your sudo user using ssh, go to file folder and run comand
sudo chmod 777 yourFile
and that it's i used to edit default file of nginx in aws vps

Thats like why not use root user instead. In lab environment, sure assign full permissions but in production that is a bad idea for so many reasons.

As a workaround, I use sudoedit and the terminal:
export SUDO_EDITOR="code-insiders --wait"
sudoedit /etc/hostname

This will open /etc/hostname in vscode. It will only save the content when the vscode tab containing hostname is closed though (that's how sudoedit works). This should work on Linux, and I suppose MacOS too. Furthermore, it also works under Remote SSH (assuming the target has sudoedit).

I finally got a chance to try this out but it didn't end up working on my Ubuntu server because sudoedit ignored all the environment variables and only uses update-alternatives which doesn't include code-insiders.
This might be a bug in Ubuntu/Debian sudoedit implementation but is a bit unfortunate.

@melink14 This is very surprising to me, as the debian manfiles still mention those environment variables. Are you sure the variable is set properly? (E.g. if you run /usr/bin/env, can you see the SUDO_EDITOR variable set?)
Anyhow, you can add your own editor to update-alternative easily enough. You should be able to make an sh file with the following content in /usr/local/bin/code-insiders-wait
#!/bin/sh
code-insiders --wait "$@"

Make sure you chmod 755 that file.
Then, run sudo update-alternatives --install /usr/bin/editor editor /usr/local/bin/code-insiders-wait 0.
You should now be able to select code-insiders-wait in the sudo update-alternatives --config editor menu.
More information on the Debian Wiki

@roblabla Yes, I was pretty surprised to but found several stack overflow posts mentioning the same thing. I'm on Ubuntu 18.04 specifically but env is definitely set correctly.
Making the global shell script and adding it to update-alternatives did work though so thanks for the detailed tips. I had tried to add code-insiders directly and failed so the idea to make a wrapper script was good!
Doesn't work great for multi-user systems but I'm almost always the only one using this system so it should work for now!

I feel it should be possible to open a file in root mode by sending a command to vscode server on the remote host after becoming a super user. E.e., once I make a connection in VS Code to my remote host, I can open a normal MacOS terminal window, ssh into the remote host and do something like this:
declare -x VSCODE_GIT_ASKPASS_MAIN="/home/username/.vscode-server/bin/3mm905126b34dcd4de91fa624eb3a8cbe7485f13/extensions/git/dist/askpass-main.js"
declare -x VSCODE_GIT_ASKPASS_NODE="/home/username/.vscode-server/bin/3mm905126b34dcd4de91fa624eb3a8cbe7485f13/node"
declare -x VSCODE_GIT_IPC_HANDLE="/run/user/7018/vscode-git-af598c8300.sock"
declare -x VSCODE_IPC_HOOK_CLI="/tmp/vscode-ipc-7dasd1b1-4e3d-4dc7-87a4-b210af87fd9e.sock"
declare -X /home/username/.vscode-server/bin/3mm905126b34dcd4de91fa624eb3a8cbe7485f13/bin
code -g test.txt
This opens test.txt in the Code.
However, if I first do sudo and then the same steps, I get
Unable to connect to VS Code server.
Error in request
Any ideas?

@yobyot Until something is implemented the terminal works with SSH-Remote. So you can edit a file then save it anywhere on the server and sudo mv it in the terminal without switching windows.

In terms of workarounds, this is actually a very simple and effective solution from @ZombieProtectionAgency , somewhat overlooked in the conversation. Plus, it forces the good practice of making changes to an important system file in a copy first before replacing the live copy. I can even use the editor to Save As within the remote file system, make edits in the already opened editor which is now the copy, then use the terminal to sudo mv. Ultimately, a one-liner.

@mldisibio This isn't a terrible work around but it's certainly not a 1 liner if you have to save-as and then sudo-mv. Especially if you have to copy and past the location of the file since it was opened from code.
I think the best workaround so far is sudo-edit which is the same idea but automatically does the copy for you.

So, It's there any way to solve this problem?

@brizer I found this thread really useful: https://github.com/microsoft/WSL/issues/4169#issuecomment-687596776
I've just left a comment there, hope it helps for you particular case

@yobyot Until something is implemented the terminal works with SSH-Remote. So you can edit a file then save it anywhere on the server and sudo mv it in the terminal without switching windows.

In terms of workarounds, this is actually a very simple and effective solution from @ZombieProtectionAgency , somewhat overlooked in the conversation. Plus, it forces the good practice of making changes to an important system file in a copy first before replacing the live copy. I can even use the editor to Save As within the remote file system, make edits in the already opened editor which is now the copy, then use the terminal to sudo mv. Ultimately, a one-liner.

This feels like an excuse for bad UX. Forcing people to switch out of the editor to perform a manual step that could easily be automated feels like dropping the user on their butt 3 feet from the finish line. If what you're actually after with requiring sudo mv is manual confirmation that the user actually wants to commit the changes to the file, a "perform elevated save?" dialog with password entry when saving to a protected location would basically be the same thing.

I've been checking this issue for a year now. Still hope that I can edit my /etc file using VS Code.
Unfortunately, most of the work around here does not provide elegant solution.
Will keep an eye on this feature.

I've been checking this issue for a year now. Still hope that I can edit my /etc file using VS Code.
Unfortunately, most of the work around here does not provide elegant solution.
Will keep an eye on this feature.

+1

Oh dear, I have quickly discovered the same weakness in using VSCODE to edit configuration files kept in /etc/variousfolders. For example prometheus' yaml config file. It seems weird that it wasn't automatically included to make life easier for developers instead of having to use the cumbersome sudo nano approach all the time. Please add this feature!

I created a .env file in my application hosted in my Ubuntu Virtual Machine, but I also get the pop up error message:
"Failed to save '.env': Unable to write file 'vscode-remote://ssh-remote+default/home/ubuntu/my_project/.env' (NoPermissions (FileSystemError): Error: EACCES: permission denied, open '/home/ubuntu/my_project/.env')"
How to gain access and being able to solve this is something I would like to learn. Any assistance on this issue is eagerly looked forward to and much appreciated.

@brizer I found this thread really useful: microsoft/WSL#4169 (comment)
I've just left a comment there, hope it helps for you particular case

Thanks. But I do not understand how this works or what to do.

I was able to set up access to specific folders and files by using the commands found here:
https://serverfault.com/questions/444867/linux-setfacl-set-all-current-future-files-directories-in-parent-directory-to
For example, I ran these commands and was able to edit files in /etc/nginx/ using VS code.
sudo setfacl -Rdm g:GROUPNAMErwx /etc/nginx/
sudo setfacl -Rm g:GROUPNAME:rwx /etc/nginx/
The acl package is required and can be installed with sudo apt-get install -y acl
Remote server is running Ubuntu 20.04.1 LTS. Not sure how safe this is for production servers.

I found one solution here:
https://www.liquidweb.com/kb/enable-root-login-via-ssh/?irgwc=1&clickid=WpMTcJVEUxyOUFDwUx0Mo3EFUkEzIe3412eIRE0&iradid=278394&irpid=123201&sharedid=&_ir=1
Its enable to login for ssh as root.
Not sure how safe this is for production servers too/

I also met the same issue when using vs code to ssh login CentOS with non-root account, eventually solved it.
After setting PermitRootLogin no and changing ssh default port to 8888 for security, my ssh config for vs code is below:
Host qcloud
    HostName <IP_ADDRESS>
    User foo
    Port 8888

The true reason of Failed to save 'default': Unable to write file (NoPermissions  (FileSystemError): Error: EACCES: permission denied, open  '/etc/nginx/sites-available/default') is below:
the new user account ("foo" here) need to get the permission of the destination directory first, we can run the command below:
sudo setfacl -R -m u:foo:rwx /etc/nginx

for my case.

More general usage:
sudo setfacl -R -m u:username:rwx /path/to/directory

This command will help you get the permission of the directory /path/to/directory, without influencing the permissions of any other user or group. Not recommend to use chown.
When you finish running above command, you can edit and save in VS code. May it be helpful for you.

I've found a workaround that seems to be working in my use case, without having to patch the VS Code files.
The issue I run into is trying to edit files owned by root, and in my case as in many others', direct SSH to root is not allowed... so what I've done is
I've added a new entry to my ~/.ssh/config file
### Try workaround to use vscode as root
Host devbox-code
	Hostname devbox.domain.com
	AddKeysToAgent yes
	User		ubuntu
	ForwardAgent no
	IdentityFile ~/.ssh/my-keypair-for-devbox
	RemoteCommand sudo -u root -i

And when I use devbox-code as the remote host to connect to in VS Code Remote-SSH, I get a working VS Editor with root context; I've tested and I can open, close write etc files that are owned by root fine.
I'm running Remote-SSH 0.51.0 and VS Code Version: 1.46.1

Hm, are you sure you didn't perform any other steps? This approach is not working for me, although that might be because of what has been said already about "RemoteCommand" being ignored.

To solve this problem:

Go to extension dir. For example at Win it` here C:\Users\Артём.vscode\extensions\ms-vscode-remote.remote-ssh-0.62.0\out
Edit file extension.js
Serch for $VSCH_DIR/server.sh
Change  start=$(millis)\n\t$VSCH_DIR/server.sh   to  start=$(millis)\n\tsudo $VSCH_DIR/server.sh

This is not so good, but it`s work! VS server process at remote host will be started as root and you can edit any files

To solve this problem:

Go to extension dir. For example at Win it` here C:\Users\username.vscode\extensions\ms-vscode-remote.remote-ssh-0.62.0\out
Edit file extension.js
Serch for $VSCH_DIR/server.sh
Change  start=$(millis)\n\t$VSCH_DIR/server.sh   to  start=$(millis)\n\tsudo $VSCH_DIR/server.sh

This is not so good, but it`s work! VS server process at remote host will be started as root and you can edit any files

Of course use/abuse of sudo should be considered, but in a controlled dev environment this seems to have solved the problem.

To solve this problem:

Go to extension dir. For example at Win it` here C:\Users\username.vscode\extensions\ms-vscode-remote.remote-ssh-0.62.0\out
Edit file extension.js
Serch for $VSCH_DIR/server.sh
Change  start=$(millis)\n\t$VSCH_DIR/server.sh   to  start=$(millis)\n\tsudo $VSCH_DIR/server.sh

This is not so good, but it`s work! VS server process at remote host will be started as root and you can edit any files

Of course use/abuse of sudo should be considered, but in a controlled dev environment this seems to have solved the problem.

Following. Hoping this gets resolved soon.

Hoping for sudo privilege feature added to Remote SSH targets

This would be nice to have.  I need to be able to connect as my domain user & then impersonate a service user to edit config files.  Currently it's not possible, it would be nice if we could sudo -u some-user -i after connecting.

I'd just like to voice my interest in the ability to elevate to root from inside vscode once you have connect to a remote ssh session

we heavily want this happen soon.

This worked for me: https://askubuntu.com/questions/1156830/please-login-as-the-user-ubuntu-rather-than-the-user-root, on EC2 Ubuntu instances.
Simply edit /root/.ssh/authorized_keys on server from
no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo 'Please login as the user \"ubuntu\" rather than the user \"root\".';echo;sleep 10" ssh-rsa KEY

to
ssh-rsa KEY

and you're able to login as root. Saving this config in the ssh config file on localhost, and using this config to log in with VSCode, you're able to edit remotely with VSCode as root.

@knutole - The security implications of allowing your key to authenticate as root are massive and, generally speaking, not a best practice as it provides the highest level of access to all aspects of the system.

The security implications depend on your system. This solution is a workaround to using VSCode remotely on systems and use-cases that are suited for it.

@knutole - The security implications of allowing your key to authenticate as root are massive and, generally speaking, not a best practice as it provides the highest level of access to all aspects of the system.

Hi. What difference between root access with key and user access with key + sudo bash (without password)? Is it equal?

Hi. What difference between root access with key and user access with key + sudo bash (without password)? Is it equal?

This is editing the authorized keys of root to suppress several ssh options and error messaging, to allow a remote user to authenticate as root, over ssh. AFAICT, this isn't "user access with key + sudo bash"
The security implications of allowing root authentication/login from SSH (with a password or otherwise) are fairly well documented across the internet:
https://www.baeldung.com/linux/root-login-over-ssh-disable
https://superuser.com/questions/1006267/why-should-i-really-disable-root-ssh-login
https://unix.stackexchange.com/questions/257824/permitrootlogin-no-and-sudo-user-where-is-the-difference
https://stackoverflow.com/questions/18395622/remote-login-as-root-in-ubuntu
Additionally, if the extension is using root instead of a standard login user, any environment configuration that the extension could/might use as part of it is lost unless you migrate all of that to root. I don't enjoy the thought of having to do that every time I need this functionality.
Several folks (including myself further up in the thread) have recommended setfacl as the work-around, and while there are 1000 ways to solve this puzzle, I still think this is the most reasonable workaround, until the extension natively supports some method of elevating user permissions.

@webdog Thanks for your input!
With PermitRootLogin prohibit-password in sshd_config, the only way to gain access is with the private key. I agree with the posts you referenced that allowing password auth is not a good idea on SSH in general. But I don't agree that root login with private key is inherently less secure: it's still impossible to login without the 4096 RSA private key, and of course impossible to guess it, root or otherwise.
I'm all for "best practices", but it's also important to understand what is actually risky and what isn't. As for environment, you might have a point, although for my particular use case it's not relevant.

setfacl

Thanks for your answer. I read all links you posted and still have same question. I'll try to add some info.
My case: I have server with ssh access by key for my user "user1". Password access in ssh entirely disabled. I'm using ansible for automatization via this user. User can do "sudo bash" without password for ansible tasks with high privileges.
Why "ssh user1@server" + "sudo bash" better than "ssh root@server" for my situation? (both with keys)
My main question about best practice. How to increase security in same case? Thank you.

I am running into a similar issue using Docker with vscode when the property "remoteUser" is set to anything but "root" in the .devcontainer/devcontainer.json file. If I set it to root, it lets me save stuff. If not, it doesn't let me write anything in the container. For now I just use root, but would like to use a non-root user eventually.

To solve this problem:

Go to extension dir. For example at Win it` here C:\Users\username.vscode\extensions\ms-vscode-remote.remote-ssh-0.62.0\out
Edit file extension.js
Serch for $VSCH_DIR/server.sh
Change  start=$(millis)\n\t$VSCH_DIR/server.sh   to  start=$(millis)\n\tsudo $VSCH_DIR/server.sh

This is not so good, but it`s work! VS server process at remote host will be started as root and you can edit any files

even if I do have sudo privileges, in my case this breaks my connection ... after this change, VS will not connect to my virtual machine anymore :/

Very much interested in this capability as well, as logging in as root directly over SSH is a no-go.

Would be very nice!

can VS code access my secure keygen codes so I can modify as sudo?

Would be great to have this feature!

would like to see this being implemented in the near future

It may not work in every circumstance, but on a remote with bash you can work around the limitation thanks to the code server's ability to read files from stdin.
If you execute the commands  below in the integrated ssh terminal, you can be logged in as a non-root user, but the write-protected files will still open right in the same window you're typing in (actually, a copy of the file, but we can make the editing experience nearly identical).
If you're okay with just opening a tempfile copy, without overwriting the old file afterwards:
sudo cat /etc/my/protected/file.txt | code -

You could then "Save As..." the file to somewhere you have write access, and then do with the file as you please. It's also convenient if you just want to view a read-protected file.
If you want to edit the file, one possibility would be to use vipe and sponge, if moreutils is available on your distro (i.e. sudo apt install moreutils on Ubuntu):
sudo cat /etc/my/protected/file.txt | EDITOR="code -w" vipe | sudo sponge /etc/my/protected/file.txt

The -w flag is needed so that code will wait to return until after the file is closed.
This could easily be rolled into a one-liner function for your .bashrc:
sucode() { sudo cat "$1" | EDITOR="code -w" vipe | sudo sponge "$1"; }

Then you can open any file as root in your current editor using:
sucode /etc/my/protected/file.txt

I'm not sure if this is totally robust, but it works in a pinch.

Rather than enter a security nightmare with root ssh logins and running code as root, I created acl-enable-for and acl-disable-for simple little scripts taken from the solutions above.
To solve this problem on a per-path basis, I run acl-enable-for /etc/nginx and make a note to run acl-disable-for /etc/nginx later 😀. Note that acl-disable-for deletes all ACLs on a path recursively.
/usr/local/bin/acl-enable-for:
#!/usr/bin/env bash

# * Enables a read/write ACL for $USER on a chosen path recursively

set -e
# ? Ensure we're running as root
if [[ `id -u` -ne 0 ]]; then
    echo 'acl-enable-for: please run as root!'
    exit 1
fi
set +e
setfacl -R -m u:$USER:rw $1

/usr/local/bin/acl-disable-for:
#!/usr/bin/env bash

# * Clears all ACLs on a chosen path recursively

set -e
# ? Ensure we're running as root
if [[ `id -u` -ne 0 ]]; then
    echo 'acl-disable-for: please run as root!'
    exit 1
fi
set +e
setfacl -Rb $1

It has been two years, and we're still stuck with poor workarounds and running sudo nano X from within a text editor. I'm still not clear why it's difficult to provide an elevation option. Since this doesn't seem like a priority, can someone with background explain the challenges in detail here to lower the barrier for contributors?

Currently this seems to be the best work around:

Make changes to file as desired in vscode
On save, click "Save As" and choose /home/{user}/myfilename
In the terminal:
sudo mv /home/{user}/myfilename /etc/nginx/{actual file location}/myfilename

I think the best work around now is sudoedit set to open with vscode; I use it often and it works great. Worst part is that for files with no extension vscode can't tell syntax highlighting automatically due to sudo edit randomly adding characters to the file it opens.

sudo chown -R myuser /path/to/folder
Running this command on the server and connecting with VS Code with the same user worked fine for me!

Using the  setfacl for me (had to change $USER to the used user in the script), but I don't particularly like it.
Indeed, while the "+" in the access list denotes it:

I don't find it clear that there are specific authorizations enabled.

sudo chown -R myuser /path/to/folder
Running this command on the server and connecting with VS Code with the same user worked fine for me!

This is like using a sledgehammer to remove a rotten tooth: it'll work, but you really don't want to do it. There's a multitude of good reasons why regular users don't own those files!
The workaround suggested by @corbanha at https://github.com/microsoft/vscode/issues/48659#issuecomment-871085291 seems to be the best way, even though it's a little cumbersome.

Scrolling down through this issue is stressful. Though, the ideas / workarounds are innovative (for this specific use case), I am still stuck questioning why they've taken over 2 years to resolve such an easy fix. Hope all goes well for the rest of you, and I wish you guys a peaceful sleep 👍

Found a solution for Windows(as client) to Linux
EDIT your
C:\Users\xinxilas.vscode\extensions\ms-vscode-remote.remote-ssh-0.65.7\out\extension.js File...
Find line

("Running script with connection command: "+l),h.isWindows)
Edit this:

from "bash" to ""
Find text:
["-o","RemoteCommand=none"]:[]
Edit this
["-o","RemoteCommand=none"]:[]
To this:
["-o",RemoteCommand="${e.RemoteCommand}"]:["-o","RemoteCommand=bash"]

Now you can use the ssh_config RemoteCommand key
Example:
Host meliteoracle_ubuntu
HostName <IP_ADDRESS>
User ubuntu
IdentityFile ~/OneDrive/.ssh/ssh1.key
RemoteCommand sudo -i -u ubuntu
The extension is simply overwriting your "RemoteCommand" on config file to none
So with the changes, now it is using the RemoteCommand when it has one
Or using RemoteCommand as "bash" so it run as excepted (as you saw i needed to remove "bash" from command line shh on first step, (because it cant use inline ssh comand + RemoteCommand togheter)
PS:
you could use as remotecommand:
"sudo bash"
In my case i wanted to get sudo access but keep my user "ubuntu" environment
So home path would be ubuntu instead of root
And the extension will install the server-side app on user "ubuntu" home folder and not on root folder..
Don't know what are the side effects doing this but its running ok here...

This issue is major hrudle. It stalks us for 3 years or so... Workaround relies on editing extension output file...

Would be nice to have this feature. Thanks in advance.

@xinxilas I tried your Windows solution with the Mac client, but it did not work. It errors me with the message "RemoteCommand is not defined". Maybe some caching going on. I tried disabling/enabling the remote-ssh extension but that did not help. It really feels as stated earlier by others that MS deliberately does not want to allow these kind of tricks although I do not understand why. Would be great if they change their mind.

I just ran into this problem as well. I was trying to modify /etc/telegraf/telegraf.conf on a remote Linux VM running on Amazon Web Services (AWS), and was unable to elevate my permissions.

I have this problem too!

I did some more experimenting and I've found a way that works. -o RemoteCommand=none is not the only thing in this extension that prevents VS Code from establishing a working ssh session after calling sudo -u newuser -i, we also need to remove bash so that VS Code does not start an additional shell session on the remote host.
Here's a HOWTO:

make sure that sudo -u newuser -i works in a regular ssh session without requesting a password
remove  "-o RemoteCommand=none" and "bash" from extension.js like so

sed -i s/"-o RemoteCommand=none"/""/ ~/.vscode/extensions/ms-vscode-remote.remote-ssh-*/out/extension.js
sed -i s/"bash"/""/ ~/.vscode/extensions/ms-vscode-remote.remote-ssh-*/out/extension.js

create an ssh config entry with a RemoteCommand like this one:

Host pi-for-newuser
  Hostname pi
  User pi
  RemoteCommand sudo -u newuser -i

This has been tested successfully with the following setups:

macOS 10.15.2 with VS Code 1.41.1/remote-ssh 0.48.0 to Raspbian (stretch)
Arch Linux with VS Code 1.38.1/remote-ssh 0.47.2 to Raspbian (stretch)

This of course is a workaround only. I hope the developers of this extension find a way to incorporate the necessary changes without breaking ssh remote connectivity for other systems.

Works like a charm. Thank you very much! @thorstenhirsch

Workaround still works in 2021:
Win10, vscode 1.59.0, ms-vscode-remote.remote-ssh-nightly-2021.8.5221
successfully connected to Amazon Linux 2 into 'ec2-user' and got vscode as root
although just the sed's are no longer relevant, so I did the 'fix' manually, here's a paste,
sorry it's not pastebin, becuase pastebin requires an account..

Someone (not me) wrote an extension to address this, I cannot endorse the security of it but a quick peak at the source code it does look straightforward.  I tried it and it worked as intended.  Not quite as smooth as something built in but pretty darn close.
https://marketplace.visualstudio.com/items?itemName=yy0931.save-as-root

Someone (not me) wrote an extension to address this, I cannot endorse the security of it but a quick peak at the source code it does look straightforward. I tried it and it worked as intended. Not quite as smooth as something built in but pretty darn close.
https://marketplace.visualstudio.com/items?itemName=yy0931.save-as-root

I have already seen the extension, but in my case, I didn't just want to save, I wanted a full IDE to run under root, where the project files are owned by root and there's no read perms to any other user,
so sure, root might be 'insecure', just take care, and for now it's choose your poison, so to speak..

How is this still not a feature after 3 years?

Probably because it got put in the backlog, which is likely ignored by
everyone in charge of the project.
If there's another reason, I'd love to hear it. The fact that this bug has
been continuously active for 3 years should indicate that this isn't a use
case that's going away, and warrants at least some official response. As I
mentioned in another comment, even a technical explaination of the issues
around this so SOMEONE can create a PR to since it would be acceptable, but
all signs point to it simply being ignored.
Maybe new would-be commenters should just start opening duplicate bugs at
this point? 🙃
On Fri, Aug 20, 2021, 6:11 PM Miguelklappes @.***>
wrote:

How is this still not a feature after 3 years?
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/microsoft/vscode/issues/48659#issuecomment-903029224,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AATDAXIBKLV55CRG656K2LDT534NTANCNFSM4E4MSQLA
.
Triage notifications on the go with GitHub Mobile for iOS
https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675
or Android
https://play.google.com/store/apps/details?id=com.github.android&utm_campaign=notification-email
.

same, looking for a solution.

Also having this issue

This issues render whole "remote-ssh" feature unusable for most admin use cases. Pull it out of the backlog please!

Unbelievable, this is such a pain.

Since adding a reaction doesn't notify anyone that this issue still exists, that's why adding +1 comments is a loader option.
Is there any way this is going to get looked at? 3 years is a long time.

+1, please add this option!

This might be off topic, but are there other IDE's that do allow privilege escalation?

Important feature for anyone on the Ops side, VSCode is a perfect tool for remote management except it's missing this feature.

Wondering why @passionsfrucht and @jkmartindale are downvoting every recent answer but well...
I'm still baffled that this doesn't have higher priority

common

Wondering why @passionsfrucht and @jkmartindale are downvoting every recent answer but well...
I'm still baffled that this doesn't have higher priority

Getting sick of the useless +1 comments that don't do anything to help maintainers to see this issue but it does keep spamming everyone watching this issue for actual updates.

I know it sucks to receive a lot of updates but realistically (and unfortunately), a million comments will get more attention than one comment with a million 👍  If the updates really bother you I recommend customizing your subscription to this issue to only get updates when you are mentioned, and when the issue is closed or reopened:
On the right side of thid page:

then:

+1 Remote SSH becomes useless after setting up sudo rules. Which obviously is a standard for security reasons.

I concur that opening a workspace or ssh instace as root is not a good idea. There instead could be an "edit file as sudo" or "save file as sudo" using existing openssh tooling.

+1 fot the last thought, "edit file as sudo" and "save file as sudo" sounds good for me.

My +1 was for running as sudo,  I do not mind having the option to ask for sudo too. But I am allergic against programs forcing me as an administrator into what risks I want to take compared to the time I have to spend. Time vs security is really what it comes down to for me. I have a lot of installations where I do not care about security at all, such as development machines and so on.... nvm I do not feel I should have to explain. An editor should help me edit, not force my security decitions. Vim does not yell at me for running it as root and vscode should also mind its own bussiness and just let me edit etc.

I'm really sorry that this is going to be annoying to the dev, but with sudo escalation really makes vscode another level for administering and developing going simultaneously. But i really gonna type another "+1" for this features!

+1 for native support
However, there is an extension that works for this

+1

4 years later and no progress 😕

4 years later and no progress 😕

As mentioned by @mattgarmon, the Columbus' egg is the super lightweight Save as Root extension by @yy0931. Which, regardless of its full name, works also in Remote - WSL  access and on native *nix systems. Based on the quite simple and quite efficient idea: import node subprocess, ask password and f** sudo save! 😄

4 years later and no progress 😕

As mentioned by @mattgarmon, the Columbus' egg is the super lightweight Save as Root extension by @yy0931.

What if you need to become root to open (or even list) files in first place? That extension solves only tiny part of the problem.

Tiny? Files that can be opened or listed only by root > files that can be edited only by root?
To me, it solves the biggest part of the problem.

4 years later and no progress 😕

As mentioned by @mattgarmon, the Columbus' egg is the super lightweight Save as Root extension by @yy0931.

What if you need to become root to open (or even list) files in first place? That extension solves only tiny part of the problem.

4 years later and no progress 😕

As mentioned by @mattgarmon, the Columbus' egg is the super lightweight Save as Root extension by @yy0931. Which, regardless of its full name, works also in Remote - WSL access and on native nix systems. Based on the quite simple and quite efficient idea: import node subprocess, ask password and f* sudo save! 😄

I do not understand why to  continue take this up. It is not what the thread is about, its not about saving as root. It is about
running vs code as root, this for me is a big diffrence.

[...] Currently there does not seem to be a way to signal a) to save as elevated user or b) to remove the readonly flag.

[...] It is not what the thread is about, its not about saving as root.

:)

Just to share: This is the solution I use for the moment.
Batfile used for vscode instead of ssh. The batfile uses original ssh though.
ssh2.bat
@echo off
setlocal enabledelayedexpansion
SETLOCAL

:loop
	set str1=%1

	if not x%str1:bash=%==x%str1% (
			SET commandString=%commandString% sudo su
			rem @echo %strl% BASH
	)  else (
			if x%str1:-T=%==x%str1% SET commandString=%commandString% %1
	)
shift

if not "%~1"=="" goto loop

@echo ssh -t%commandString%
ssh -t%commandString%
SET %commandString%=
ENDLOCAL

The drawback of this for me is that I do not want to be sudo root on production macines, just on devmachines. Also I have to be able to nopassw sudo.
I can sometimes use "setfacl -dRm u:user:rwX,g:user:rwX dir" but I feel it is as bad as the above. This because the files I want to protect are still within the dir. The system itself is just as easy to reinstall if compromised.
Using the batfile and not allowing nopass sudo for now reminds me to change remote-ssh config.

I want to clarify something about this feature.  It is not purely a "let me edit remote files as root" problem.
There are many other use cases where you can have a system user of some sort that owns the files in subdirectory, and that user is intentionally a user that has no associated ssh keys, and is not intended to be anything other than to provide isolation and file ownership.
PHP using php-fpm, or Apache with mod_php and the apache user getting access to files via group membership, are two common configurations in the PHP world.  It's common in these scenarios to have multiple websites being served with different users owning each site project directory.  For example, "siteFooUsr" and "SiteBarUsr", created for siteFoo and SiteBar respectively.    Being able to sudo su - user is the way any admin or developer would navigate this type of configuration.
It's unfortunate that the plugin interferes with something you could easily setup in the .ssh/config file with remoteCommand.

I just came across a solution, for Linux remotes, that I haven't seen mentioned here yet: use bindfs.
To enable editing /etc as root for my user by creating and working in a directory ~/bind-mount/etc:
mkdir -p ~/bind-mount/etc
sudo bindfs --map=root/$USER /etc ~/bind-mount/etc
sudo umount ~/bind-mount/etc # When you're done

bindfs has many options. I'm not sure if --map is the best for this use but seems to work well in my testing so far. Lets you rename and move files/folders as expected.
Don't forget the security implications of any such bind.

I had been trying all of the methods suggested above (RemoteCommand or ProxyJump etc) but none worked for me but finally the most simplest solution worked (or atleast in my use case + Public key based auth). I wanted to be able to edit any file on the remote host (through VSCode) which all are pretty much root owned.
Workaround: Nothing changed on VSCode or extension side and login to remote host with normal user BUT added sudo su command under my user's bashrc on target host which did the trick and i am able to edit and save files.
Note: Obviously the terminal switches to root with this but in case you wish to work under your own/normal user in terminal then just do: sudo -u normal_user -i exit
This does not effect the elevated rights for file editing/saving.

This worked perfectly for me. Thanks a lot! This really was the simplest solution

Still no Solution

The bottom line here is that in multiple web and dev scenarios, there will be files which an admin / developer will want to edit which they are not the owner of, either via sudo, (or su - to become the correct file owner).
There are also numerous files and folders on a typical system which are root 700 permissions because they contain configuration info / passwords that non-priv users should not be able to see.  being able to save as root using the  @yy0931 extension solves only a small part of the issue.
Other solutions proposed offer some merits, but are still not a solution for what is really needed.
What I would like is that if in the terminal I run sudo -i  or su - {user}   etc, that my status / user change is reflected in the explorer and editor windows.
Until this issue is fixed, I cannot use VSC as a daily driver, because this lacking functionality is a dealbreaker for any workflow.

Is this where I leave my obligatory...

+1, been waiting and hoping for three years that somebody would actually pick this up

comment, in hopes the dev team will see and be swayed?
I'm pretty amazed that this hasn't been picked up yet, frankly.  This would simplify so much of my workflow, and I can't imagine that I'm the only one...

I realize something like this introduces security risks.
But we don't need a complete run vscode as root mode, all we need is the ability to modify files that require root permissions.
Right now, I have to open up the terminal and switch to root but that means I have to modify the files using vim or nano which means I lose all the cool vscode shortcuts and other features.
All we need is a simple popup:
"editing this file requires root, would you like to run the save command for this file as root?" Or "viewing this file requires root, would you like to open this file as root?"
Of course a complete root browsing mode would much better but starting out, it would be nice to have the option to run root mode only on the selected file.

What I would like is that if in the terminal I run sudo -i or su - {user} etc, that my status / user change is reflected in the explorer and editor windows.

The terminal is a convenience, nothing more, and in no way should be bound or associated with the editor.  Technically, the editing session is implemented as its own connection, and that is the way it should be.
The problem with the current extension, as has been shown previously, is that it interferes with common shell based solutions that would allow people to get around this problem.  It interferes with those solutions unnecessarily.   Other editors that have similar remote editing features allow you to set up the connection in whatever way you need to.

I realize something like this introduces security risks. But we don't need a complete run vscode as root mode, all we need is the ability to modify files that require root permissions.

There is no inherent security risk, and this is not an "edit root files" issue.  If an account allows escalation to root upon login, you can set that up, and edit root owned files without issue.
There are many other accounts that you might want to use to edit files with, which are also accounts that you can't log into from the shell, and this is even more of a problem for that scenario.  SSH literally has the ability to accomplish an effective login, and the problem with this plugin is that it has some code that goes around the built in features of ssh, while still relying on them to make the secure connection to the server.

I realize something like this introduces security risks. But we don't need a complete run vscode as root mode, all we need is the ability to modify files that require root permissions.

There is no inherent security risk, and this is not an "edit root files" issue.  If an account allows escalation to root upon login, you can set that up, and edit root owned files without issue.
There are many other accounts that you might want to use to edit files with, which are also accounts that you can't log into from the shell, and this is even more of a problem for that scenario.  SSH literally has the ability to accomplish an effective login, and the problem with this plugin is that it has some code that goes around the built in features of ssh, while still relying on them to make the secure connection to the server.

The code that goes around the builtin features of ssh, Is it necessary for vscode to connect or is it just poorly designed?

It is very disappointing that in 2022 the answers to 'How do I edit a file I need sudo to save' in a modern IDE are 'open a terminal and maybe use vi or something', 'run IDE/connection as root', 'chown all the files' or 'chmod a+rwx everything' with countless other tickets being opened and closed regarding the same topic.
Sadly it seems like this entire issue has been completely abandoned by the maintainers (no response other than closing other issues asking for this since ~2019) so I suppose I'm just venting :(

A few months ago I was even searching for alternatives, but sadly, I haven't found anything.
That such a normally trivial thing of sudo editing a file cannot be done with an extension that is meant for productive SSH usage is just ridiculous.

are we getting feature or what?

Dealing with permissions is a whole extra can of worms on top of just a general abstraction for a file system.
If it were added...

Should it work on classic Unix permission ideas?
What about the various common ACLs?
Does this work for non-Linux remotes as well?

Maybe it's a new/extended API/object info just for the specific needs of this file system abstraction?
Something like:

(For each fs object) What are my permissions (none, read only, or read & write)?
Elevate access to this path [with these credentials?]

Would those two API changes/extensions cover all (or most) desired use cases?
The problems I see with this are:

Is "elevate" enough? Does there also need to be a "elevateWith" (secrets) or "elevateAs" (alternate user)?
How to handle multiple concurrent elevations? (To the same file?)
How to possibly integrate with the shell for features like "Run as..."

+1

I'm amazed that this problem still hasn't been solved after all these years

We all are

I'm amazed that people are complaining on an open source and free software after all these years.
A few options for you:

Kindly wait until it's solved. You can even be supportive or provide useful ideas
It's as simple as you think it is and to prove your point, you raise a fix yourself
Put a :heavy_dollar_sign: on Fiver to get someone else to do the work for you and raise a PR

But when something is free and open source, try not to complain about a roadmap that doesn't fit your needs.

To the point that maxime1992 made someone did fix this at least for the use case of editing config files.  I had the same issue in editing nginx config files so I did the workaround mentioned save a copy in my home folder then use sudo cp to copy over the config file in /etc.  I just started using this extension and it works perfectly. I don't have to run vscode as root the whole time just when I save the config file; much safer and the code is nice and small so you can read through it all.
Save as root by yy0931
https://marketplace.visualstudio.com/items?itemName=yy0931.save-as-root

For me the feature is not specific to root neither to save files. It's to become a specific user before loading the project.
I think vscode could simply provide a parameter to become a specific user, the same way ansible for example does it: https://docs.ansible.com/ansible/2.3/become.html
Finally, while I can't do this, I'll have to create a new key pair to ssh directly as the user I want ...
I really think this feature is legitimate and should be implemented.
Regards.

I also experienced the issue of not being able to edit config files.
Another thing I noticed is that some files are missing from the file explorer.
For example, a file belonging to another user/group inside /etc was not present in the remote explorer but can be viewed in the terminal using sudo ls /etc/path/to/file

Maybe this tiny workaround will be helpful for someone: I Made a hardlink to only root visible file in my home catalog with ln -P /root/some_file ~/some_file_hardlink. Now I can open it from home catalog and save as root with the help of save as root plugin.

Maybe this tiny workaround will be helpful for someone: I Made a hardlink to only root visible file in my home catalog with ln -P /root/some_file ~/some_file_hardlink. Now I can open it from home catalog and save as root with the help of save as root plugin.

Maybe this tiny workaround will be helpful for someone: I Made a hardlink in my home catalog to only root visible file with ln -P /root/some_file ~/some_file_hardlink. Now I can open it from my home catalog and save as root with the help of Save as Root in Remote - SSH plugin.

Hi every one,
I have this issue: [Save as Root] spawn sudo ENOENT.
I don't no how to fixed this.
Please help me, thanks so much.

"Save as Root" works, but I would also like to open files in /etc. First I thought this is a joke :). But it's true that this is open since years. Nice...

Hi, I dont know if that will work for any one but it's solution I found. I use extension remote tunnels to connect vscode to server. When I open the tunnel, I open as root,  so when i connect with vscode i connect as root.

When I open the tunnel, I open as root

That's what people are trying to avoid

Ok, sorry I didn't follow all conversation

And why is that ? So I have a reason to stop doing it. Thanks

@raul-bns that is a security best practice. Root should not be allowed for remote login (therefore, for many of us, that's not even an option because of corporate/personal policies/practices). We would need to first login as non-root and still then to elevate privileges/gain permissions.

Hey thanks and sorry I've discover that i was using very bad practice. 😅

This workaround works for me:
~/.ssh/config:
Host <name>
Hostname <IP>
User <username>
RemoteCommand sudo su -
RequestTTY force

This workaround works for me:
~/.ssh/config:
Host <name>
Hostname <IP>
User <username>
RemoteCommand sudo su -
RequestTTY force

This is not a solution for people other than those who want to login as root.  It also forces all ssh connections to that server to escalate to root.   For many people, neither thing is wanted.  If your actual goal is to become a non-root user, that does not have login credentials, this is untenable.  I will say that essentially, people have been asking for the equivalent per connection capability to be configurable within the plugin.

@7owl7
What does the command "RequestTTY force" do?

@7owl7 What does the command "RequestTTY force" do?

It tells ssh that this connection requires a tty.
A tty (or in this case a pseudo-tty) is an interactive environment that provides a bunch of capabilities for when you connect to a server.  It supports certain character codes for interactive editing of text in the command line, and being able to stop a running program using ctrl-c.
When you connect to a server using ssh, and you don't provide any additional commands, the ssh server will create a pty.  However, if you specify additional commands, ssh assumes that you don't want a pty, which could interfere with the commands you are sending.  You also could be using ssh to transfer binary data, so again in that situation you don't want a pty that could interpret data as pty commands.
In this case, the configuration of RequestTTY force is associated with the RemoteCommand configuration, that will be immediately running (upon connection) the "sudo su -" command.
So it's overriding the default behavior of not having a PTY, to always having a pty.

Workaround, complementary extension to save as root: https://marketplace.visualstudio.com/items?itemName=yy0931.save-as-root

Damn 5 years and this is still not a feature?

The extension mentioned above is a good alternative, but this should honestly be a feature already.

I added a solution to this problem here! It is clean, doesn't require an extension, and just works.
https://github.com/microsoft/vscode-remote-release/issues/1688#issuecomment-1708577380

its 2024 would really love to have this feature natively for remote ssh


Error Schedule Pod if kubectl enable

Description
Pod scheduling fails if kubectl is true
executors.kubectl-read-only.kubectl.enabled=true
When the value is false, the pod is in the running state.
Log Container:
- level=info msg=Closing... component="Analytics reporter"
- time="2022-09-07T22:02:30Z" level=info msg="Shutdown requested. Finishing..." component="Metrics server"
- while creating resource name normalizer: while getting resource list from K8s cluster: unable to retrieve the complete list of server APIs: custom.metrics.k8s.io/v1beta1: the server is currently unable to handle the request

Expected behavior

Schedule pod BotKube.

Actual behavior

Pod scheduling fails.

Steps to reproduce
helm install --version v0.13.0 botkube --namespace botkube --create-namespace \
--set communications.default-group.slack.enabled=true \
--set communications.default-group.slack.channels.default.name=${SLACK_CHANNEL_NAME} \
--set communications.default-group.slack.token=${SLACK_API_BOT_TOKEN} \
--set settings.clusterName=${CLUSTER_NAME} \
--set executors.kubectl-read-only.kubectl.enabled=${ALLOW_KUBECTL} \
botkube/botkube

Hi @nuvme-devops
Thanks for reporting the issue and attached logs.
When you enable the kubectl executor.  We fetch the supported groups and resources from API Server. It is an external call using client-go to API server. Based on the logs, it looks like it is a problem with the K8s itself:
unable to retrieve the complete list of server APIs: custom.metrics.k8s.io/v1beta1: the server is currently unable to handle the request

Here is a great answer to a similar problem provided by Brendan Burns:

For anyone who hits this, it's caused by api-services that no longer have backends running...
In my case it was KEDA, but there are a number of different services that install aggregated API servers.
To fix it:
kubectl get apiservice

Look for ones the AVAILABLE is False
If you don't need those APIs any more, delete them:
kubectl delete apiservce <service-name>

source: https://github.com/helm/helm/issues/6361#issuecomment-538220109
In the future version of BotKube we will get rid of fetching the supported groups and resources from API Server. It will be removed once the https://github.com/kubeshop/botkube/issues/685 will be implemented. For now, you need to ensure that the ServerGroupsAndResources call can be executed properly.

Hi @mszostok
Thanks for your return.
I'm checking about the APISERVICE.
Interestingly, on the same cluster v0.12.4 works fine.

Fixed as a part of https://github.com/kubeshop/botkube/pull/834


Data forwarding doesn't use calibrated values

Description:
Data forwarding doesn't use calibrated values.

From support email
I use the android app to collect sensor data. It works as expected,
the dashboard shows the calibrated values, the history shows
calibrated past values, and when exported into a csv file, the values
are still calibrated. Even bluetooth sync works well, and the synced
values are also calibrated.
Recently I set up a small server side app, and I forward the sensor
data via the android app to this endpoint. What I get on the server
side is a JSON data structure as expected. However, in this JSON data
the temperature, humidity and pressure values are the raw values (as
measured by the sensor, with no calibration), and the calibration
offset values (e.g TemperatureOffset) are all set to 0.0, despite
having non-zero values in my android app.
E.g. when the sensor measures 23.0 C, and in the app the calibration
offset is 2 C, then the dashboard shows 25 C, the history shows 25 C,
the CSV export contains 25 C values. But for the same measurement the
server side app gets a JSON data structure containing 23 C for
temperature, and 0.0 as tempOffset.

@andreevdenis Tested and confirmed offset values shown in log. QA passed.


⚠ Slack has degraded performance

In 1f88638, Slack (https://status.slack.com/api/v2.0.0/current) experienced degraded performance:

HTTP code: 200
Response time: 41 ms

Resolved: Slack performance has improved in 17253bc.


Correctly handle services being unavailable

If services are unavailable we can end up accepting an MQTT connection but not granting any rights. This is not helpful.
We should reject the connection with an appropriate server-not-ready disconnection code.

Currently for username/password auth we will fail authentication if services are unavailable; this is better than nothing, but not ideal. #179 is to extend this handling to GSSAPI auth.


Add feature to build rules based on users, groups on Proxy/Squid

yay!

@kekek2 thanks for this, but can you please check you code for PSR-2 compatibility (https://docs.opnsense.org/development/guidelines.html)?  There are quite some missing curly braces in there.

This plugin depends on https://github.com/opnsense/core/pull/1892

It can use proxy-sso:
https://github.com/kekek2/plugins/blob/ProxyUserACL/www/web-proxy-useracl/src/opnsense/service/templates/OPNsense/ProxyUserACL/ProxyUserACL.conf#L23
But proxy-sso is not required

Thanks, I'll do some post-op stuff for style, whitespace and menu


[Bug] invisible Buttons

Hi,
first of all, great idea with the Plugin, this is something i have been searching for a while now.
Maybe this is already known, but there seems to be a problem with some of the Buttons on the keyboard being invisible.
They still work if you press them.
I installed only this Plugin in a brand new Vault to eliminate possible conflicts with other Plugins.

Obsidian Version: 1.3.5

Ouch .. How do you activate the keyboard ?
It seems invisible for me :

Obsidian on linux

Ouch .. How do you activate the keyboard ? It seems invisible for me :
Obsidian 1.3.5 on linux

i start the plugin with CTRL + P and entering the command.
This time with a larger Screenshot:

the keyboard opens at the same time as the editor in your screenshot.
Here a larger screenshot:

Thanks, @mofoni, for your feedback.
Hmm  it does not seem to work like this for me :

Or... I'm completely dumb (highly possible)

Thanks, @mofoni, for your feedback. Hmm it does not seem to work like this for me :

Or... I'm completely dumb (highly possible)

By default no keyboard too
I'm do
cd .obsidian/plugins
git clone https://github.com/danzilberdan/obsidian-mathlive.git
mv obsidian-mathlive mathlive

Then in package.json change version mathlive to
	"dependencies": {
		"mathlive": "^0.95.0"
	}

In main.ts  86 row
simple to this
const mfe = new MathfieldElement();
than
npm i
npm run build

I will implement this fix asap. Thanks for the help!

I just published the fix.
Let me know if there are more issues.

Thank you.
But new css not compared with my obsidian / theme.
So I'm fix a bit.

:root {
  --selection-background-color: rgba(0,0,0,0.5);
  --selection-color: green;
  --highlight-text: green;
  --contains-highlight-background-color: rgba(0,0,0,0.5);;
}

.mathlive-modal-content {
  display: flex;
  flex-direction: column;
  justify-content: space-between;
  align-items: end;
  padding-top: 1rem;
}

math-field {
  font-size: 2rem;
  width: 100%;
  overflow: hidden;
  border-radius: 15px 15px 0 0;
}

.submit {
  background-color: green !important;
  font-weight: bold;
  color: white;
  height: 100%;
  width: 100%;
  height: 2rem;
  margin-top:1px;
  border-radius: 0 0 15px 15px;
}

I'm think it may help somebody.


Search Apple Music

Extension
https://www.raycast.com/fedevitaledev/music
Description
Would it be possible to add a command to search Apple Music (if Apple expose it?)
Who will benefit from this feature?
All users
Anything else?
No response

Unfortunately, there's no way to achieve that view AppleScript :/

@raycastbot close this issue

@raycastbot close this issue


I'll get this merged and push a new version to npm right now.


Emojicode bubble sort implementation.

Emojicode documentation and more: https://www.emojicode.org/

If it's emojicode, I will personally close the PR.

- Me during today's stream
I must admit: It's hard to resist the urge.

First off, I think it’s great someone finally adds a real language to this project. 😉
You can, however, improve your code by taking advantage of that fact that lists are in fact iterable:
🔂 number numbers 🍇
   😀 🔡 numbers 10❗❗
🍉

is enough to print the list.

Feel free to review the code, if you want!

@thbwd Thanks for the review! I applied the suggested changes.

If @thbwd approves, I also approve. Thanks for the review!


Ctrl-C doesn't exit cat command

It doesn't look like you can stop the output of cat.

New version of nsh will be based on coreutils.js

:+1:


Bug 5578/s/v2

Ticket
If your pull request is related to a Suricata ticket, please provide
the full URL to the ticket here so this pull request can monitor
changes to the ticket status:
Redmine ticket: https://redmine.openinfosecfoundation.org/issues/5578
Previous PR: https://github.com/OISF/suricata-verify/pull/1285
Changes since v1:

rebase

Can we have a README file for the bug-5578 test, please? :)


Issue-1430 java.lang.StackOverflowError on cancelled download request

Catch the EOFException with cause message Connection reset by peer in OutputStream.write() and flush(). Change request status to 202 ACCEPTED for debug logs.
This pull request closes #1430
Acceptance Test

[x] Building the code with mvn clean install -Dintegration.tests still works.
[x] Running mvn spring-boot:run in the strongbox-web-core still starts up the application correctly.
[x] Building the code and running the strongbox-distribution from a zip or tar.gz still works.
[x] The tests in the strongbox-web-integration-tests still run properly.

Questions

Does this pull request break backward compatibility?

[ ] Yes
[x] No

Does this pull request require other pull requests to be merged first?

[ ] Yes, please see #...
[x] No

Does this require an update of the documentation?

[ ] Yes, please see strongbox/strongbox-docs#{PR_NUMBER}
[x] No

Thanks @BogdanSukonnov for your PR !
Could you please share with us a gist  containing logs/exception when you cancelled download request ?

@fuss86 @BogdanSukonnov shouldn't this be placed in DefaultExceptionHandler?

shouldn't this be placed in DefaultExceptionHandler instead of BaseController?

I'll try to catch EOFException in DefaultExceptionHandler. Not sure  that I can distinguish OutputStream from InputStream there.

@BogdanSukonnov never mind, seems you right and this should be in BaseController. Just checking options, thanks for clarifying :)

Could you please share with us a gist  containing logs/exception when you cancelled download request ?

logs after fix

@fuss86 can you help me to understand the state of this PR? Do you need to confirm that requestaed changes are done? Or it just waits for merging by team?

There is one unresolved comment. I think we should add a check IOException.class == e.getCause().getClass().
@sbespalov what do you think ?

@fuss86 good that you asked. I actually just noticed that in your gist there is org.eclipse.jetty.io.EofException but in BaseController the java.io.EOFException catches. @BogdanSukonnov  is there any reason why we can't catch original org.eclipse.jetty.io.EofException? It's seems that org.eclipse.jetty.io.EofException within flush should be enough and we even don't need to check the cause message.
The other thing is that we probably better decorate the response.getOutputStream() with something like ProxyOutputStream and try...catch the flush there to be sure that we have what expected within this issue. After this we can re-throw something custom like ConnectionResetByPeerException and catch this exception in BaseController in turn.

@sbespalov I use java.io.EOFException as server independent solution. Didn't find any advantage in using org.eclipse.jetty.io.EofException. As said in docs

The only difference in handling is that Jetty EOFs are logged less verbosely.

I believe that if we need to check message (do not sure about this either) in BaseController - we need to do it with both of this classes. Of course if we want to catch exception not in BaseCotroller than org.eclipse.jetty.io.EofException will help us to distinguish between EOF received from the connection from any other case.  But i'm a beginner, so you definetly know better.
About this decorator pattern I'm afraid it's too much for me. You just will waist to much time, correcting my decisions. I don't know. What do you think?

@sbespalov , @fuss86 ,
@steve-todorov and I have been thinking of some day investigating Netty (for a few reasons I won't get into right now) and perhaps it would be better to keep this generic for now, unless you feel strongly.

@sbespalov / @fuss86 ,
I have reviewed this and I think it looks okay. Feel free to merge it when both of you are happy with the changes.

@BogdanSukonnov ,
Thank you very much for your help and congratulations on your first pull request!

@BogdanSukonnov regarding the fact that org.eclipse.jetty.io.EofException is platform specific the thing is that this issue in general is platform specific and even with java.io.EOFException there is a chance that Tomcat or Netty will throw something else and this will not work like this, especially with message verification.
Purposed solution assumed to use exception handling logic within composition, and OutputStream decorator implementation can be different depending on environment.
Anyway, it's seems we have following options:

As most of the people happy with current implementation we can merge it as it is and get back to it in the future if needed.
If you interested to learn some patterns then we can continue and I will help to make it generic and flexible for real with decorated stream solution proposed above.

@sbespalov it's really interesting, I'll try Tomcat and may be JetFly. And to practice some patterns sounds good to me. Thanks!

@BogdanSukonnov ok, please proceed then
To be clear regarding Jetty specific decorator I mean that you should extend the org.apache.commons.io.output.ProxyOutputStream which will rethrow the org.eclipse.jetty.io.EofException  as Http202PropogateException.
Also if need more help then I am available at our chat.

@sbespalov please check the last commit. Is it what you ment?

@BogdanSukonnov this looks good, just few comments.

@fuss86 , @sbespalov ,
Would you mind re-reviewing this? Thanks! :)

@BogdanSukonnov : Could you please rebase this pull request? Thanks! :)

@BogdanSukonnov ,
The username under which you're committing and pushing to Github seems to be mis-configured. You will have to look into how to configure your git settings properly, amend the author of the commits and then force push back to the branch. (When your user is properly set up, you see your avatar when against your commits in the commit history, otherwise it's a default grey avatar).

@carlspring thanks, Martin! The problem with user was just a dot in email in one place and no dot in another. I added both variants in GitHub profile. No need to force push.

@BogdanSukonnov : Thanks for fixing it! :)


refactor: cleanup unused monitor functions

What type of PR is this?

What this PR does / why we need it:
Which issue(s) this PR fixes:

Fixes #
Requirements:

[ ] uses conventional commit messages

[ ] includes documentation
[ ] adds unit tests
[ ] tested upgrade from previous version

Special notes for your reviewer:
Release note:
none

these are only in vhd now, also p sure aks vm extension has similar monitors anyway these days


Remove dependencies on external static files

Allows for local Orchestra development without Internet access.

lgtm, but add the version strings before merging!:)
no need for another review in my opinion :shipit:


Hydras & Co. 0.5

Motivation for this change
https://github.com/coq-community/hydra-battles/releases/tag/v0.5
This new version of the Hydras & Co. packages includes a new gaia-hydras package.
Things done

Built on platform(s)

[x] x86_64-linux
[ ] aarch64-linux
[ ] x86_64-darwin
[ ] aarch64-darwin

[ ] For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
[ ] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
[ ] Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
[ ] Tested execution of all binary files (usually in ./result/bin/)
21.11 Release Notes (or backporting 21.05 Release notes)

[ ] (Package updates) Added a release notes entry if the change is major or breaking
[ ] (Module updates) Added a release notes entry if the change is significant
[ ] (Module addition) Added a release notes entry if adding a new NixOS module

[x] Fits CONTRIBUTING.md.

There's something unsatisfying in having to repeat the same information on the available releases in three different packages, but I don't really know a better way to do this. Maybe @CohenCyril, with his experience of packaging math-comp, has suggestions?

In mathcomp there are two additional packages: a mathcomp-single package and a mathcomp meta-package, additionally all packages inside mathcomp are co-generated, i.e. there is a nix function that builds derivations:
https://github.com/NixOS/nixpkgs/blob/5193b0da80e702570684a545cb8a83991d4d9adf/pkgs/development/coq-modules/mathcomp/default.nix#L45

Result of nixpkgs-review pr 142071 run on x86_64-darwin 1

4 packages built:

coqPackages.addition-chains
coqPackages.gaia-hydras
coqPackages.goedel
coqPackages.hydra-battles


Add fix for baseUrl functionality

I added a variable to the httpConfig method that will form the full http request url if any changes have been made via AuthProvider.baseUrl and recompiled lib/devise.js and lib/devise-min.js to include the new addition.
I also fixed a small indention linting issue with the baseUrl function.

Please merge me.

Is this service still being maintained?


Feature | Add Shared account to template

What?

Add shared account to the template
Layers to include:

tf-backend
identities
network
security

Add security layer to the already present accounts.

Addressed in this PR.


Actions testing & workflow submission

@tezansahu you should not be merging code into PEcAn repositories without anyone doing code review first. I've updated the settings on this repo to now require code review.
Also, I had a question about the assumption that users will pass an XML file to the submit workflow function. Under the work pattern of the existing API that @ashiklom developed (aside: it still feels like we're reinventing wheels here), users are likely to build up there settings object in R using code, rather than writing a valid XML by hand in a separate file. Even if they have an existing XML, they may be reading it in, modifying it by code, and then submitting it. With your proposed pattern I suspect we're going to see a lot of people writing XML's to file so they can be passed to your function, which on it's very first line just reads that XML from file.

Oh sure...I will keep that in mind next time onwards.
I actually plan to implement 2-3 ways of workflow submission, which includes XML, JSON and form-data (most likely that way that you are mentioning about the settings object). And hence, I started with XML.
Moreover, I also plan to implement a function that could generate an XML file after users put in the desired details about models, sites, etc.


Unquoted AssertionConsumerServiceURL gives pareser error

Recently SuiteCRM implemented a news version of php-saml: 2.10.2.
This used to be a really old v1.x, which worked fine, but was unsafe.
This new version does lead to a problem, though: logging in doesn't work and Firefox SAMLtracer shows me I get a parsererror:
<parsererror>
    <sourcetext>    AssertionConsumerServiceURL="https://test.xxx.nl//index.php?action=Login&module=Users">
-----------------------------------------------------------------------------------------------^</sourcetext>
</parsererror>

I suspect replacing the quotes with '"' is the culprit, as without the quotes the content is seen as part of the xml and is then parsed (which probably doesn't work with characters like & and ?).
I can see these quotes are in place with the old version of php-saml in SuiteCRM.
See my original report as SuiteCRM issue #2819 and it's new issue: #3270.
It seems they think it's the php-saml library though.

@pitbulk Any suggestion?  Which code is adding the " around the URL?  Which code is converting the " to "?  Is the " even necessary to have around the URL?  Could the " around the URL be removed?  Should it be removed?

Hi @chris001,
I really don't know where you get the  parsing error and how are you using the php-saml toolkit on SuiteCRM.
It seems that you experience issues with SuiteCRM connecting it with Google or simpleSAMLphp,
but if you run the demo1 and configure it with Google or simpleSAMLphp you will see that the demo1 works... so I don't think is something related with php-saml and instead, how you use it on SuiteCRM.

Hi @chris001 ,
I edited onelogin/php-saml/lib/Saml2/AuthnRequest.php. I replaced the var with AssertionConsumerServiceURL= {$spData['assertionConsumerService']['url']} but yet cannot get to excape & being parsed to & I also tried changing it in settings.php but no success yet. Current string shows: AssertionConsumerServiceURL= https://URL/index.php?action=Login&module=Users

@pitbulk   @apano

Are you adding extra GET parameters on ACS URL? Why you need to do that?
SuiteCRM is based on SugarCRM, which is a php web application first developed in 2004, so practically every page of the app uses GET parameters, instead of rewritten SEF url's.  So the login URL is https://www.mysuitecrmapp.com/index.php?action=Login&module=Users

Would it be accurate to say, the php-saml code is urlencoding the AssertionConsumerService URL (the return URL to go back to the application) when it should just add on its own get or post parameters and not urlencode the URL?

@chris001
In my case I am not adding extra GET parameters. The login URL is defined by the main config site_url and then from sp_base. The AssertionConsumerServiceURL I pasted, is the one I receive from Firefox's SAML Plugin, but I confirm that what arrives to ADFS is correctly parsed https://www.mysuitecrmapp.com/index.php?action=Login&module=Users. I have been checking older versions of SuiteCRM and SugarCRM to check if there is something else to change for the federation but no luck.

I reviewed simpleSAMLphp and it do nothing related with encoding on assertionConsumerServiceURL.
I see that there is a problem with urls that includes GET parameters, but I don't see urlencoding the whole URL as a solution (I think that can carry new issues).
The demo1 uses ? and works, so I think the issue is related with the &.
Have you checked to use as AssertionConsumerServiceURL
https://www.mysuitecrmapp.com/index.php?action=Login&module=Users
(html entity encoded version?)

@apano @chris001 @ebogaard
Can you verify #218 solve the issue?

This fixes the problem.
Great!

@pitbulk We have an IDP that fails to match the Destination URL set in the OneLogin_Saml2_AuthnRequest constructor.
Adding the following resolved it; could it be related to #218? This is also due to the & character being in their SSO URL.
php-saml\lib\Saml2\AuthnRequest.php
Line 118: $sso_url = htmlspecialchars($idpData['singleSignOnService']['url'], ENT_QUOTES);
...
Line 129: Destination="{$sso_url}"

The SSO URL belong the IdP side.
What IdP software are you using that adds an & on its SSO URL?

It's a customers IDP (possibly homegrown). Unfortunately due to the size of their company they won't change how their URLs are constructed so it was the only way to resolve the issue while maintaining compatibility with other IDPs.

Ok, not very common to find that.
P.S if the SLO URL has also & you will need to transform them as well.

I just ran into this in version 3.4.1, the "destination" needs htmlspecialchars applied to it as well:
$spEntityId = htmlspecialchars($spData['entityId'], ENT_QUOTES);
$acsUrl = htmlspecialchars($spData['assertionConsumerService']['url'], ENT_QUOTES);
$destination = htmlspecialchars($idpData['singleSignOnService']['url'], ENT_QUOTES);

the idp url has a "&" in it.


new version of lichess released = extension broken

Hi,
As I told you recently, lichess got a major upgrade. The HTML has changed quite a bit and as a result your most excellent extension is not working anymore.
Just a heads up in case you want to update it. The actual frontend of lichess is now stable and may be built upon.

OH YEAH!! Dmitri voice is back. Sounds so good!

we need to get this back to work again gentelmans


Fix code sample for assertion extension

Static assertThat should return an Assert instance, not an instance of the object under test.

Thanks!


Modifications to run on openmind, refactoring, and auto-formatting.

Summary of changes:

This code now runs on openmind, the cluster where the data is stored.  The data directories are different on openmind, so this required a few changes to paths.
A small change to the timescale transform (removing the bias), since I've modified the behavior in the dataset to eliminate the need for a bias.
Some renaming and refactoring, particularly in the main script.
Some auto-formatting.
Associated modifications to the README.

Something I just noticed @nwatters01
The new separation of the interfaces into the timeseries_interfaces.py file, but behavior_interfaces.py is still around, resulting in duplication of the interfaces (and some slight differences with the new ones?) making it confusing which one is supposed to be used
Did you mean to delete the original behavior_interfaces.py in this refactor?

@nwatters01 The summary of changes seemed to miss an important aspect: you also added two new data interfaces for data streams we haven't seen before
So I'm giving that side of this PR the usual more rigorous look over for best practices, etc.
BTW how do you feel about isort as a pre-commit?

@CodyCBakerPhD Thank you for the review!  Yes I meant to remove behavior_interface.py.  Just did that and am updating the PR.
And yes I added the reward and audio data streams.  I've never used isort before, but if you prefer using that, I'm happy to give it a try --- what does it offer?

And yes I added the reward and audio data streams. I've never used isort before, but if you prefer using that, I'm happy to give it a try --- what does it offer?

Orders global imports by (a) those belonging to Python standard, (b) external packages, (c) locally defined modules
We have always followed this convention ourselves ($\pm$ human error) albeit manually, isort just runs in the background with the other pre-commits such as black

Oh, that sounds good.  I'll apply isort and update the PR.

@nwatters01 One small conflict here now - also I didn't realize the pre-commit bot wasn't even running yet on this repo so I enabled that

I ran into a github rabbit hole trying to merge this repo with my fork, so instead I made a branch "nwatters" to this repo with all of these changes.
I think at this point the only thing I need to do is change to LabeledEvents structure, then that branch will be ready for merging.

In light of the github troubles I'm having with my fork, can we delete this pull request and switch to this one?
https://github.com/catalystneuro/jazayeri-lab-to-nwb/pull/13
That has all the same changes, but is actually merge-able into the main repo.

replaced by #13