0

I make virtual environments.

How to create "ssh virtualhost" environment?

host - vm01(ssh01.host.com) 202.xx.xx.xx
     - vm01(ssh02.host.com) 202.xx.xx.xx(same IP)

ssh [email protected] -> ssh01 ssh [email protected] -> ssh02

Improve this question

6 Answers 6

Reset to default
3

What is the difference in the environments that you expect the users logging in to land in?

In the Apache world, when you connect to an IP configured for virtual hosting, Apache checks inside that config block to see if things like DocumentRoot and is overridden vs the default virtual host or default server config.

So what's different about the unix environment you want to present via two hostnames?

The names you used above don't make it clear whether you have two distinct VMs behind the host operating system or whether you just have one.

If the former, then there's no real way to do it with just one external IP address - either you have to give the host two IPs and set up forwarding so that port 22 on one IP goes to vm01 and port 22 on the other IP goes to port 22 on vm02, or you have to use different ports, in which case port 22 on the host goes to vm02 port 22 and port 8022 (for example) on the host goes to port 22 on vm02.

If the latter, then you'll need to explain the differences between the two places you want users to land to get better feedback.

Improve this answer
1

Just point those two sub-domains to the same IP?

As far as I know, sshd_config has no equivalent to the <VirtualHost> directive of httpd, allowing you to create totally different environments based on the hostname the client uses to connect.

Improve this answer
2
  • Thanks a lot.Yes I have a IP address ,so two sub-domains have same IP. May not I create ssh virtualhost?
    – freddiefujiwra
    Jul 3, 2009 at 5:25
  • Firstly, sub-domains don't need to point to the same IP address. Secondly, as James F has stated very well, you don't explain what the purpose of these virtual hosts is. To segment user access? Then use groups/privileges. To route to different VMs? See below. As we've said, since there is no in-built concept of an ssh VirtualHost, we're left guessing what you want to do with one if it did exist.
    – msanford
    Jul 3, 2009 at 15:33
1

No, there's no equivalent to virtual hosts for openSSH. The best thing you could do would be possibly running different openSSHds on different ports, if what you wish to do is changable in openssh's config file. (i.e ssh01.host.com:22, ssh01.host.com:23)

Improve this answer
1
  • +1 With caveat: if you do that, you won't be able to do any global connection throttling (max startups) or implement centrally-managed security policy (key length, timeout, etc). Sure you can copy the files, but you'll then have to go and change every one to change the system, which may be tedious and lead to inconsistent configurations across subdomains/daemons.
    – msanford
    Jul 3, 2009 at 15:37
0

One thing you can do is have different SSH keys launch different commands (eg, xm console /blah/ )

Improve this answer
0

You need to use non-standard ssh-ports for your VMs.

I use openVZ on my server and have three virtual machines with VIDs 101,102,201. I thought, that it would be convinient to ssh into 101 VM through 101 port, into 102 through 102 and so on. To connect to the hardware node you can use 22 port.

So I added this routing rules to iptables on hardware node:

#iptables -t nat -A PREROUTING -d x.x.x.x -p tcp -m tcp --dport 101 -j DNAT --to-destination 192.168.2.101:22 
#iptables -t nat -A PREROUTING -d x.x.x.x -p tcp -m tcp --dport 102 -j DNAT --to-destination 192.168.2.102:22 
#iptables -t nat -A PREROUTING -d x.x.x.x -p tcp -m tcp --dport 201 -j DNAT --to-destination 192.168.2.201:22
#/etc/init.d/iptables save
Improve this answer
0

If you want this to be fairly transparent to the end user, I recommend setting up two different SSH daemons listening on different ports. This is very similar to my home setup, where SSHing in gets me to the router, but SSH on port 2222 gets me to my server.

Then in your ssh config, add something like:

Host ssh01.host.com
    HostName 202.xx.xx.xx
Host ssh02.host.com
    HostName 202.xx.xx.xx
    Port 2222

Now, you can just 'ssh [email protected]' and ssh will Do the Right Thing™.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .