We’ll use the TLS protocol and its SNI extension together with the SSH Prox圜ommand feature. So, we have to wrap the connections inside another protocol that will help on that point. As said previously, HAProxy doesn’t analyze the SSH protocol and, anyway, this protocol doesn’t provide any hint about the destination. In order to route the SSH connections to different servers, you have to know which server the user wants to access. Route your SSH connections to a specific server,Īdd a security layer in order to restrict the login ability based on client certificates. Route your SSH connections to a predefined list of backend servers, You will see how you can expose only one public-facing address but: In this blog post, you will learn a method that bypasses this limitation. This limitation is due to the fact that the SSH protocol doesn’t provide any hint about its final destination, as well as HAProxy doesn’t analyze the protocol. Although TCP mode is simple to use, it requires you to listen on multiple ports or addresses and map those ports and addresses to specific backends. Some of you may already handle SSH connections through HAProxy with HAProxy’s TCP mode. Route SSH connections through HAProxy using the SSH Prox圜ommand feature and SNI.ĭid you know that you can proxy SSH connections through HAProxy and route based on hostname? The advantage is that you can relay all SSH traffic through one public-facing server instead of needing to grant users direct access to potentially hundreds of internal servers from outside the network.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |