3 ms·

So this is effectively like ProxyJump, just with the jump node exposed over SSL and backed by HAProxy binary instead of OpenSSH? What benefits do you see? I me

So this is effectively like ProxyJump, just with the jump node exposed over SSL and backed by HAProxy binary instead of OpenSSH? What benefits do you see? I mean, you still expose some binary that implements authentication and authorization using cryptography. I think that even RBAC scenarios described in the link above should be achievable with OpenSSH, right?

betaby 2y ago
It's not about RBAC at all. Goal is not to expose ssh socket to the Internet! ssh tcp is encapsulated in https packet and ONLY after successful certificate auth by HAProxy.
- aflukasz 2y ago
  Right, but now your are exposing HA proxy socket to the Internet. Why is that better?