Option for removing the New->Terminal menu entry.

[GrahamDumpleton]

There should be an official option for removing the New->Terminal menu entry.

This has been asked many times before, such as in jupyterhub/jupyterhub#1195, but also on StackOverflow and in other forums. The answer always get dismissed with the argument that people can execute code in the notebook anyway, or shell out a terminal command. That is quite valid when the kernel is run on the same host, or in the same container, as the Jupyter Notebook web interface, but when you are running a kernel on a remote host using the kernel_gateway and nb2kg packages, or enterprise kernel gateway, the terminal would be created on a different system to where the kernel is running.

In this case of using a kernel gateway, you don't necessarily want people to be able to create the terminal or even see the menu item, because it will run on the system where the Jupyter Notebook web interface is running, not where the kernel is running. You may want to prevent this, leaving the only place a user can run code being where the kernel is running.

The suggestion of uninstalling terminado package after it has been installed, or setting SHELL to /bin/false are both clunky solutions and don't get rid of the menu entry.

[takluyver]

Yep, I think the option makes sense, I've just always been concerned when people ask for it that they're assuming disabling terminals is enough to secure a system against untrusted users.

Do you want to make a PR adding a config option to disable terminals?

[GrahamDumpleton]

JavaScript, Tornado, and existing notebook code base is outside of my knowledge, so I would probably need a lot of guidance on this one to work out what to do. I suspect it isn't as simple as not showing the option in the menu item as you likely need to also ensure that certain URL handlers related to terminals are disabled if it is also possible to access a URL directly to create a terminal. Any guidance you can give on what needs to change?

[takluyver]

It's probably relatively easy in this case, because the frontend stuff already has to handle the case where terminado isn't installed. So it just needs an explicit option to disable it. Have a look at the init_terminals method in notebookapp.py.

[takluyver]

It's probably relatively easy in this case, because the frontend stuff already has to handle the case where terminado isn't installed. So it just needs an explicit option to disable it. Have a look at the init_terminals method in notebookapp.py.

[takluyver]

#3478 should fix this.