4 ms·
Once just for fun I setup HAProxy in TCP mode and depending on the host name would direct the SSH to the correct host. But I had some nice ACLs so that if they
by nerdbaggy 8y ago
Once just for fun I setup HAProxy in TCP mode and depending on the host name would direct the SSH to the correct host. But I had some nice ACLs so that if they weren’t in the ACL they would be sent to a honeypot.
- zamadatix 8y agoHow did HAProxy know the host name?
- xnyan 8y agoSNI https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication
- rkeene2 8y agoSSH does not use TLS, and does not have the TLS extension SNI.
- oarsinsync 7y agoIt can be tunnelled over TLS using openssl
- rkeene2 7y agoThat is true (and relatively easy to do with OpenSSH's ProxyCommand) but that was not the implication of the statement that HAProxy was being used in TCP mode to direct incoming TCP sockets to the correct backend SSH server based on the hostname using any SSH client that understands the SSH protocol.
- nerdbaggy 8y agoRequired some client stuff. I did something like this https://coolaj86.com/articles/adventures-in-haproxy-tcp-tls-https-ssh-openvpn/ https://coolaj86.com/articles/adventures-in-haproxy-tcp-tls-... at the “Detecting SSH over HTTPS” part