我试图通过https连接使用haproxy设置SSH。 我还没有find任何工作的例子，所以任何帮助，将不胜感激！
客户端configuration;
~$ cat ~/.stunnel/stunnel.conf pid= client=yes foreground=yes [ssh] accept=4444 connect=ssh.example.com:443 客户输出;
~$ stunnel ~/.stunnel/stunnel.conf 2014.08.15 10:16:50 LOG5[5454]: stunnel 5.02 on x86_64-unknown-linux-gnu platform 2014.08.15 10:26:05 LOG5[5598]: s_connect: connected 115.0.0.0:443 2014.08.15 10:26:05 LOG5[5598]: Service [ssh] connected remote server from 10.0.0.0:45343 2014.08.15 10:26:05 LOG5[5598]: Connection closed: 23 byte(s) sent to SSL, 188 byte(s) sent to socket ~$ ssh -v -p 4444 user@localhost debug1: Local version string SSH-2.0-OpenSSH_6.6.1 debug1: ssh_exchange_identification: HTTP/1.0 400 Bad request
服务器configuration;
~$ cat /etc/haproxy/haproxy.cfg global log /dev/log local0 log /dev/log local1 notice chroot /var/lib/haproxy stats socket /run/haproxy/admin.sock mode 660 level admin stats timeout 30s user haproxy group haproxy daemon maxconn 500 ca-base /etc/ssl/certs crt-base /etc/ssl/private ssl-default-bind-ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-RSA-RC4-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES128-SHA:AES256-SHA256:AES256-SHA:RC4-SHA defaults log global mode http option tcplog timeout connect 20s timeout client 50s timeout server 50s timeout tunnel 1h frontend public mode tcp bind :443 ssl crt example.pem no-tls-tickets tcp-request inspect-delay 5s tcp-request content accept if HTTP use_backend ssh if !HTTP use_backend ssh if { hdr(host) -i ssh.example.com } use_backend btsync if { hdr(host) -i btsync.example.com } default_backend nginx backend nginx reqadd X-Forwarded-Proto:\ https server nginx localhost:8001 check backend btsync server btsync localhost:8888 check backend ssh mode tcp server ssh localhost:22 timeout server 2h
服务器输出
~$ tail -f /var/log/haproxy.log Aug 15 16:10:20 localhost haproxy[42548]: 203.0.0.0:52385 [15/Aug/2014:16:10:20.278] public~ nginx/<NOSRV> -1/-1/83 187 PR 0/0/0/0/3 0/0
据我可以告诉stunnel实际上并没有连接到ssh.example.com子域名，它只是做一个查询，并通过IP连接，因此haproxy内的路由将主要nginx块…
我设法得到它通过使用ssl_fc_sni而不是hdr(host)来selectSSH后端，
use_backend ssh if { ssl_fc_sni ssh.ceaseless.info }
我没有设法使用ssl_fc_sni，所以我用另一种方法 。 基本上，它包括检查连接的第一个数据包是否以string“SSH-2.0”开始。 这转化为：
acl client_attempts_ssh payload(0,7) -m bin 5353482d322e30 use_backend ssh if !HTTP use_backend ssh if client_attempts_ssh
我希望有人认为这是有用的。