Remote Deployment using SSH Tunneling and HTTPS/TLS¶

When you run the Data Science Workbench container on a remote computer, you must use a secure access method. If you do not use encryption, the system transmits your credentials, data, and communications between the web browser and the remote workbench in plain text across the network. This unencrypted transmission exposes your information to interception.

Select one of the following secure access methods:

• An SSH tunnel
• An HTTPS/TLS connection that uses self-signed certificates

Using an SSH Tunnel¶

1. Configure the code-server application on the remote server:

   bind-addr: 0.0.0.0:8080
   auth: password
   password: vscode
   

2. Start the Data Science Workbench container on the remote server:

   docker run --rm -it -p 8080:8080 --name datascience \
     -v /local/path/homecoder:/home/coder \
     -v /local/path/requirements.txt:/tmp/requirements.txt \
     -v /local/path/vscode-ext.txt:/tmp/vscode-ext.txt \
     -v /local/path/config.yaml:/tmp/config.yaml \
     actian/datascience:1.0.0
   

3. Start the SSH tunnel on your local computer:

   ssh -N -L 8080:localhost:8080 <user>@<REMOTE_IP_ADDRESS>
   

   Authenticate as the user <user>. Do not close the terminal session, because the terminal session must remain active to maintain the network tunnel.

4. Open the Data Science Workbench interface:

   http://localhost:8080
   

Using HTTPS/TLS with Self-Signed Certificates¶

To configure an HTTPS/TLS connection, perform the following steps:

1. Generate a root certificate authority (CA) on the remote server:

   openssl genrsa -out myRootCA.key 4096
   

   openssl req -x509 -new -nodes \
     -key myRootCA.key \
     -sha256 -days 3650 \
     -out myRootCA.crt \
     -subj "/CN=Lab-Root-CA"
   

   This command generates the following output files:

   • myRootCA.key: Protect this private key file. Do not share the file.
   • myRootCA.crt: Copy this certificate file to the local computer that runs the web browser.

2. Generate the server key on the remote server:

   openssl genrsa -out server.key 2048
   

3. Create a configuration file named server.cnf on the remote server:

   [req]
   default_bits = 2048
   prompt = no
   default_md = sha256
   distinguished_name = dn
   req_extensions = req_ext
   
   [dn]
   CN = <HOSTNAME.DOMAIN>
   
   [req_ext]
   subjectAltName = @alt_names
   
   [alt_names]
   DNS.1 = <HOSTNAME.DOMAIN>
   IP.1 = <IP_ADDRESS>
   

4. Create a certificate signing request (CSR) on the remote server:

   openssl req -new -key server.key -out server.csr -config server.cnf
   

5. Sign the server certificate by using your root CA on the remote server:

   openssl x509 -req \
     -in server.csr \
     -CA myRootCA.crt \
     -CAkey myRootCA.key \
     -CAcreateserial \
     -out server.crt \
     -days 365 \
     -sha256 \
     -extfile server.cnf \
     -extensions req_ext
   

   This command generates the following output files:

   • server.crt
   • server.key

6. Configure the code-server application on the remote server:

   bind-addr: 0.0.0.0:8443
   auth: password
   password: vscode
   cert: /tmp/server.crt
   cert-key: /tmp/server.key
   

7. Copy the myRootCA.crt file from the remote server to your local computer.

8. Install the root CA certificate on your local computer.

   • If you use Windows, open a PowerShell terminal and enter the following command:

   Import-Certificate -FilePath myRootCA.crt -CertStoreLocation Cert:\LocalMachine\Root
   

   • If you use macOS, open a Terminal session and enter the following command:

   sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain myRootCA.crt
   

   • If you use Linux, open a Terminal session and enter the following commands:

   sudo cp myRootCA.crt /usr/local/share/ca-certificates/
   sudo update-ca-certificates
   

9. Start the Data Science Workbench container on the remote server:

   docker run --rm -it -p 8443:8443 --name datascience \
       -v /local/path/homecoder:/home/coder \
       -v /local/path/requirements.txt:/tmp/requirements.txt \
       -v /local/path/vscode-ext.txt:/tmp/vscode-ext.txt \
       -v /local/path/config.yaml:/tmp/config.yaml \
       -v /local/path/server.crt:/tmp/server.crt \
       -v /local/path/server.key:/tmp/server.key \
       actian/datascience:1.0.0
   

10. Open the Data Science Workbench interface. You must use the identical host name or the identical IP address that you specified in the certificate configuration.

    https://<hostname>.<domain>:8443
    
    or
    
    https://<IP_ADDRESS>:8443