25

When using the ssh or ftp commands from the Bash shell, does the server that I am connecting to learn of the domain name used? I understand that the domain name is locally translated into an IP address via DNS. In HTTP, after that happens, the server is told the original domain name as well in order to serve the correct page, or to present the correct TLS cert (SNI).

host serverfault.com
GET /

Does a similar phenomenon happen when connecting to ssh or ftp?

I ask because I am trying to ssh into a server (GoDaddy webhosting) which expects a domain name, but is not letting me in when I try to connect via user@IPaddress as the DNS is not yet moved to the GoDaddy IP address.

  • Do you have .ssh/config specific to the host name (or the IP address)? What error do you get? (Hmm, this is support, but not to the goal of answering the question...) – Andreas Krey Mar 2 '15 at 7:18
  • Just the generic Login authentication failed for FTP and Permission denied for SSH. The actual connection is fine, and I've quadruple-checked the login credentials. – dotancohen Mar 2 '15 at 7:22
25

No, the SSH clients do not pass the DNS name you connected to on to the server.
As you said correctly, the name is resolved locally to the IP address.

It looks like I was wrong about FTP.
See the other answer for details.

  • 5
    It's not true for FTP anymore. See my answer – Martin Prikryl Mar 2 '15 at 9:02
  • Interesting, I didn't know that. I edited my answer. Thanks! – faker Mar 2 '15 at 9:26
  • Actually, as of 2015 the unedited answer is still correct in the majority of cases. That may change in the next few years, though. – dotancohen Mar 2 '15 at 9:56
  • I'm wondering how many clients support it yet. In any case your answer is more correct. – faker Mar 2 '15 at 9:58
  • @faker I have added little information about client-side support I know atm. May do some further research later. – Martin Prikryl Mar 2 '15 at 10:19
34
+50

The SSH/SFTP protocol does not have any mechanism to provide the host to the server.

There was a discussion about adding this functionality to OpenSSH, see "Virtual hosts" for ssh.


The FTP protocol does have HOST command, which is an equivalent to the HTTP Host header. It is specified by a relatively new RFC 7151. The RFC was published in March 2014 (though the first draft is from 2007). As such, it is not universally supported yet.

On a server-side, it's supported by IIS (the RFC is sponsored by Microsoft) and ProFTPD (since 1.3.6rc1). It's not supported by other common Unix FTP servers like Pure-FTPd or vsftpd.

On a client-side, it is supported by (my) WinSCP. It's not supported by FileZilla, as its author oppose the idea, nor by CyberDuck. I do not know about others.

  • Thank you, this will be an important consideration in the next few years when people come across this issue and google this question. – dotancohen Mar 2 '15 at 9:22
  • 1
    That's nice to know. I wish something like that existed for ssh as well, because I do have the need for a frontend that can dispatch ssh connections made to one IP address to different servers based on hostname. But all my previous research agree with your conclusion, that it does not exist for ssh, and it cannot be easily added to the protocol. – kasperd Mar 2 '15 at 9:50
  • @kasperd, you could use different port numbers for the different connections. Or you could do it based on username. – A E Mar 2 '15 at 18:10
  • @AE Neither approach would work for my use case. By the time I need to decide which server to send the connection to, the client has not yet send the username. (Moreover I'm pretty sure the username is only send encrypted, and I don't know how to mitm an ssh connection to extract the username.) Port number won't work either because my frontend actually performs a DNS lookup of the hostname in order to find the backend. (The frontend is dual stack, the backends don't have any public IPv4 address, the purpose of the frontend is to make the backends accessible to IPv4-only clients.) – kasperd Mar 2 '15 at 18:50
  • 2
    @kasperd I have added a link to OpenSSH mailing list thread about adding this to SSH. – Martin Prikryl Mar 3 '15 at 9:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.