I would like to have a front end with HAProxy on port 443. This front end acts in the following way:
It decrypts the contents of the connection and checks:
1- If the encrypted contents of the connection is ssh, i.e., if the first words of the packets are
SSH-2.0, then it forwards the decrypted packets to port 22. I assume such a back end looks like this:
backend ssh mode tcp option tcplog server ssh 127.0.0.1:22 timeout server 2h
2- If the encrypted contents are anything else, then forward the encrypted contents to port 8443, which contains an Apache server with correct SNI keys. If it's a must to include all correct SNI keys for each web address (in order not to look as a man-in-the-middle-attack, could you please tell me how to do that with an example? I have no problem adding all keys to HAProxy.
Why? Because I already have apache working on port 443. I would like to move it to some other port without having to rewrite my whole configuration. So I would like to move it to port 8443 for example, and then tell HAProxy, if the connection is not SSH, then just forward everything you get to port 443.
How do I write such a front end + back ends? Please assist.
I current have the following front end as a starting point:
frontend ssl bind 0.0.0.0:443 ssl crt /home/myuser/SSL/certs.pem no-sslv3 #decrypts the connection with the keys certs.pem mode tcp option tcplog tcp-request inspect-delay 5s tcp-request content accept if HTTP acl client_attempts_ssh payload(0,7) -m bin 5353482d322e30 #if the decrypted information starts with SSH-2.0 use_backend ssh if client_attempts_ssh #forward to SSH if condition client_attempts_ssh is satisfied. use_backend forwardToApache if !client_attempts_ssh
Please ask if you require any additional details.