4 ms·

What if you already run a web server which uses port 443? Strange that the readme doesn't mention that scenario because it's extremely common. Presumably you'd

What if you already run a web server which uses port 443? Strange that the readme doesn't mention that scenario because it's extremely common. Presumably you'd choose a different port but then it'd be pretty obvious you're running something if your server has a random HTTPS server exposed on port 444 or whatever.

xgbi 3y ago
Can't you simply `proxy_pass` the traffic with any load balancer or reverse proxy (that you probably have anyways if you use TLS)?
okasaki 3y ago
You can run different hosts on one web server, like company.com goes to localhost:5555 (your app or whatever) and ssh.company.com goes to localhost:8443 (let's say you're running ssh3 on that port)
- qingcharles 3y ago
  * depending on your web server/reverse proxy configuration [for instance, I run Kestrel and it really isn't designed to target more than one site; I do it, but it's like bending that Lego brick to make it fit where it shouldn't go]
  - okasaki 3y ago
    Yes I suppose, although you can always put a web server that does support it (like nginx) in front of your web server that doesn't support it.
    - qingcharles 3y ago
      Yeah, this is what MS used to recommend, although they now say their own version YARP is better.
xyst 3y ago
Front load service with nginx server or load balancer… nginx exposed on 443: if route is /web then route to web service on port 1234 if route is /ssh3-secret-string -> route to ssh3 server service on port 1265 if route doesn’t exist then 404 …
- extraduder_ire 3y ago
  Can nginx proxy-pass encrypted data now? I tried this before and failed pretty hard, had to use HAproxy at the time and pass based on the hostname in the SNI header. Was still pretty unreliable. If so, I assume the encryption on the SSH is handled separately from the http headers.
  - xyst 3y ago
    https://nginx.org/en/docs/quic.html https://nginx.org/en/docs/quic.html Since 1.25.0
ajross 3y ago
SSHv2 is likewise trivially probable though ("nc $HOST 22" replies with "SSH-2.0-whatever"!), and that never hurt it. If you want to hide your services from attackers, there are many tools for that. I don't see why it needs to be part of the application protocol.
eichin 3y ago
That already has a (brutal) solution now - sslh https://www.rutschle.net/tech/sslh/README.html https://www.rutschle.net/tech/sslh/README.html - the current version is more sophisticated, but it was originally just a perl script that would send the connection to sshd or the https web server, based on regex matching on an initial string (and I probably timing out and going to sshd if it didn't see one? Something like that, I haven't dug out the old code to check.)

xgbi 3y ago

Can't you simply `proxy_pass` the traffic with any load balancer or reverse proxy (that you probably have anyways if you use TLS)?

okasaki 3y ago

You can run different hosts on one web server, like company.com goes to localhost:5555 (your app or whatever) and ssh.company.com goes to localhost:8443 (let's say you're running ssh3 on that port)

qingcharles 3y ago
* depending on your web server/reverse proxy configuration [for instance, I run Kestrel and it really isn't designed to target more than one site; I do it, but it's like bending that Lego brick to make it fit where it shouldn't go]
- okasaki 3y ago
  Yes I suppose, although you can always put a web server that does support it (like nginx) in front of your web server that doesn't support it.
  - qingcharles 3y ago
    Yeah, this is what MS used to recommend, although they now say their own version YARP is better.

xyst 3y ago

Front load service with nginx server or load balancer… nginx exposed on 443: if route is /web then route to web service on port 1234 if route is /ssh3-secret-string -> route to ssh3 server service on port 1265 if route doesn’t exist then 404 …

extraduder_ire 3y ago
Can nginx proxy-pass encrypted data now? I tried this before and failed pretty hard, had to use HAproxy at the time and pass based on the hostname in the SNI header. Was still pretty unreliable. If so, I assume the encryption on the SSH is handled separately from the http headers.
- xyst 3y ago
  https://nginx.org/en/docs/quic.html https://nginx.org/en/docs/quic.html Since 1.25.0

ajross 3y ago

SSHv2 is likewise trivially probable though ("nc $HOST 22" replies with "SSH-2.0-whatever"!), and that never hurt it. If you want to hide your services from attackers, there are many tools for that. I don't see why it needs to be part of the application protocol.

eichin 3y ago

That already has a (brutal) solution now - sslh https://www.rutschle.net/tech/sslh/README.html https://www.rutschle.net/tech/sslh/README.html - the current version is more sophisticated, but it was originally just a perl script that would send the connection to sshd or the https web server, based on regex matching on an initial string (and I probably timing out and going to sshd if it didn't see one? Something like that, I haven't dug out the old code to check.)