Not by itself. The Jupyter Server documentation states that disabling terminals does not make the server more secure, because anything a user can do in a terminal they can also do in a notebook. It trims the interface. Real control comes from who can reach the server and what account it runs as.
What the setting does
Jupyter Server has a terminals_enabled option. The configuration reference says it controls whether terminals are available, and adds the caution directly: this does not make the server more secure by itself. Anything the user can do in a terminal, they can also do in a notebook. Terminals may also be disabled automatically when the terminado package is missing.
c.ServerApp.terminals_enabled = False
Check the default for your version in the configuration reference, since defaults can change between releases.
Why a notebook is enough
A kernel can run system commands and read and write files. The security documentation says execute permission, which covers terminals and kernels, generally means arbitrary code execution. So removing one door while the other stays open changes little. See /resources/blog/jupyter-execute-permission-means-arbitrary-code-authorizer-explained.
What turning terminals off is good for
| Reason | Does it help |
|---|---|
| Reduce accidental shell use by novices | Yes |
| Simplify the interface for a class | Yes |
| Satisfy a checklist item on its own | Weak, the capability remains through kernels |
| Stop a determined authenticated user | No |
| Reduce what an unauthenticated visitor can do | No, authentication does that |
What does make a difference
- Authentication on, with a token or password, and never both empty on a reachable host.
- A server account with only the files and network access that users need.
- One container or account per user, so a kernel cannot touch another person's work.
- No production credentials in the account's environment or files.
- Network controls: localhost only, or behind an authenticating proxy with HTTPS.
- Package and extension review for the server environment, since extensions run as the server. See /resources/blog/can-a-jupyterlab-extension-run-code-on-the-server.
How to explain it to an auditor
State what the setting does and what it does not. Disabling terminals is a usability and hygiene measure. The controls that bound a user are identity, account privileges, isolation and network exposure. Record those, with evidence such as configuration files and access lists.
Safeguard's compliance and evidence automation can help you collect and keep that kind of evidence. Dependency checks for the server environment are available through the free scan at gold.safeguard.sh/scan.
Quick check
If terminals are off, can a user still run shell commands?
Yes, through a notebook kernel. The documentation says anything possible in a terminal is possible in a notebook.
Is the setting still worth using?
For simplifying the interface, yes. It is not an access control.
Sources
- Jupyter Server configuration reference, fetched 19 October 2026.
- Security in the Jupyter Server, Jupyter documentation, fetched 19 October 2026.
Last reviewed: 19 October 2026.
