1

I've a following situation:

network1 - gate - network2
  • network2 has several services.
  • network1 has a lot of developers.

I need to make access from developers to services with separated access, for example:

  • dev1 should have access to debug ports on host1 and host2,
  • dev2 should have access to debug portal on host1 and host3 and host4
  • dev3 should have access to http, debug and jmx ports on host6

So I need one authentication and authorization system for different services. HAProxy could work on TCP level, so I need in AA system, I think radius should be fine.

Is it possible to connect radius with haproxy and make accesses how I'd like to make them ?

Improve this question
6
  • Are you talking about using authentication in a HAProxy ACL, or to log onto the HAProxy box itself? Not entirely sure how haproxy fits into your network here.
    – Mark Henderson
    Dec 3, 2015 at 14:58
  • I don't have HAProxy in my network yet, I'm searching for solution. So you could describe both options.
    – alterpub
    Dec 3, 2015 at 15:01
  • 1
    haproxy is unlikely to be suitable for what you want. haproxy is a load balancer. The only way you can reliably stop people from accessing ports on a different network is with a firewall, and it sounds like that's what you need here.
    – Mark Henderson
    Dec 3, 2015 at 15:04
  • I'm using NAT now, but I don't what use it. HAProxy has TCP balancer, so if someone go to somehost.local:specific_port could be redirected with HAProxy to someip:port, but I've read that HAProxy can do HTTP Auth, so we could combine it, but for http auth I need login:pass, which I think could be get from Radius.
    – alterpub
    Dec 3, 2015 at 15:16
  • Regarding the hostname part, someone else just asked the same thing: serverfault.com/q/740560/7709 - can't be done for most protocols. Yes haproxy can do TCP load balancing, but you're not using it for that, you're mostly just going to be using it for its ACLs. And you can't do http auth on anything except http itself, so you could just us a normal reverse proxy for the HTTP protocols. Something like nginx.
    – Mark Henderson
    Dec 3, 2015 at 15:18

1 Answer 1

Reset to default
0

I think that your only solution is a custom web application that, when a user logs in, it creates a temporary NAT rule for it (or allows the traffic to the NATted port temporarily).

Improve this answer
1
  • The main idea - do not use NAT.
    – alterpub
    Dec 4, 2015 at 6:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .