9 ms·

In some setups I decided to have jumphost via HAproxy ssl as described there https://www.haproxy.com/blog/route-ssh-connections-with-haproxy https://www.haproxy

by betaby 2y ago

In some setups I decided to have jumphost via HAproxy ssl as described there https://www.haproxy.com/blog/route-ssh-connections-with-haproxy https://www.haproxy.com/blog/route-ssh-connections-with-hapr... so no ssh directly exposed at all.

aflukasz 2y ago
So this is effectively like ProxyJump, just with the jump node exposed over SSL and backed by HAProxy binary instead of OpenSSH? What benefits do you see? I mean, you still expose some binary that implements authentication and authorization using cryptography. I think that even RBAC scenarios described in the link above should be achievable with OpenSSH, right?
- betaby 2y ago
  It's not about RBAC at all. Goal is not to expose ssh socket to the Internet! ssh tcp is encapsulated in https packet and ONLY after successful certificate auth by HAProxy.
  - aflukasz 2y ago
    Right, but now your are exposing HA proxy socket to the Internet. Why is that better?