I would like to have a front end with HAProxy on port 443. This front end acts in the following way:

It decrypts the contents of the connection and checks:

1- If the encrypted contents of the connection is ssh, i.e., if the first words of the packets are SSH-2.0, then it forwards the decrypted packets to port 22. I assume such a back end looks like this:

backend ssh
    mode tcp
    option tcplog
    server ssh
    timeout server 2h

2- If the encrypted contents are anything else, then forward the encrypted contents to port 8443, which contains an Apache server with correct SNI keys. If it's a must to include all correct SNI keys for each web address (in order not to look as a man-in-the-middle-attack, could you please tell me how to do that with an example? I have no problem adding all keys to HAProxy.

Why? Because I already have apache working on port 443. I would like to move it to some other port without having to rewrite my whole configuration. So I would like to move it to port 8443 for example, and then tell HAProxy, if the connection is not SSH, then just forward everything you get to port 443.

How do I write such a front end + back ends? Please assist.

I current have the following front end as a starting point:

frontend ssl
    bind ssl crt /home/myuser/SSL/certs.pem no-sslv3   #decrypts the connection with the keys certs.pem
    mode tcp
    option tcplog
    tcp-request inspect-delay 5s
    tcp-request content accept if HTTP
    acl client_attempts_ssh payload(0,7) -m bin 5353482d322e30   #if the decrypted information starts with SSH-2.0

    use_backend ssh if client_attempts_ssh   #forward to SSH if condition client_attempts_ssh is satisfied.
    use_backend forwardToApache if !client_attempts_ssh

Please ask if you require any additional details.

Thank you.

  • There's so many weird things with what you're trying to do, but I'll leave those for now. For starters, can you post your full config, and what's actually wrong/not working. – GregL Mar 4 '16 at 13:24
  • @GregL My initial config is in this link blog.chmd.fr/… . The difference with my situation is that I have port 443 already in use by apache, meaning that I have to move apache to some other port. Let me know if you need more details. – The Quantum Physicist Mar 4 '16 at 13:32
  • That links explains most of the weirdness I was seeing. It might be worth updating your question to include some of the details from it, so that it's more clear. The question still remains: what's not working? – GregL Mar 4 '16 at 13:49
  • 1
    Wouldn't sslh solve your problems? – HBruijn Mar 4 '16 at 13:53
  • 1
    Isn't your situation just like the one in the link, only that you want the local apache on 8443 while it's at 80 in the example? – BeerSerc Mar 4 '16 at 14:08

You could use SNI first, selecting




and only if ssh.domain.com is selected you decrypt, do the ssh magic and send it to a local webserver unencrypted, assuming this is supposed to look like regular https traffic, but doesn't contain sensitive information inside the https content, because this is handled by site1 and site2.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.