2

I have a server with Apache webserver on it and many websites running on http (port 80) and https (port 443). I would like to use a proxy on port 443 in between Apache and the user. In this page, there's a tutorial on how to do it. It sounds fancy in the sense that it detects automatically whether the incoming connection is SSH or not, and if it's, it automatically forwards it to port 22.

I have configured my HAProxy in /etc/haproxy/haproxy.cfg as was mentioned in that link. The following is my config file:

global
        log /dev/log    local0
        log /dev/log    local1 notice
        chroot /var/lib/haproxy
        stats socket /etc/haproxy/admin.sock mode 660 level admin
        stats timeout 30s
        user haproxy
        group haproxy
        daemon

        # Default SSL material locations
#       ca-base /etc/ssl/certs
#       crt-base /etc/ssl/private
        ca-base /home/myuser/SSL/
        crt-base /home/myuser/SSL/

        # Default ciphers to use on SSL-enabled listening sockets.
        # For more information, see ciphers(1SSL). This list is from:
        #  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
        ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
        ssl-default-bind-options no-sslv3

        tune.ssl.default-dh-param 2048


defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        timeout connect 5000
        timeout client  50000
        timeout server  50000
        errorfile 400 /etc/haproxy/errors/400.http
        errorfile 403 /etc/haproxy/errors/403.http
        errorfile 408 /etc/haproxy/errors/408.http
        errorfile 500 /etc/haproxy/errors/500.http
        errorfile 502 /etc/haproxy/errors/502.http
        errorfile 503 /etc/haproxy/errors/503.http
        errorfile 504 /etc/haproxy/errors/504.http

backend secure_http
    reqadd X-Forwarded-Proto:\ https
    rspadd Strict-Transport-Security:\ max-age=31536000
    mode http
    option httplog
    option forwardfor
    server local_http_server 127.0.0.1:80

backend ssh
    mode tcp
    option tcplog
    server ssh 127.0.0.1:22
    timeout server 2h

frontend ssl
    bind 0.0.0.0:443 ssl crt /home/myuser/SSL/certs.pem no-sslv3
    mode tcp
    option tcplog
    tcp-request inspect-delay 5s
    tcp-request content accept if HTTP
    acl client_attempts_ssh payload(0,7) -m bin 5353482d322e30
    use_backend ssh if !HTTP
    use_backend ssh if client_attempts_ssh
    use_backend secure_http if HTTP

The problem:

The tutorial apparently assumes that port 443 is not being used by Apache, where HAProxy binds to this port, and receives secure connections from the user. This means that I have to change hell lot of things in my Apache configuration to make all my websites on the webserver use port 80 instead of 443 and disable SSL-Engines in my virtual hosts. I would like to avoid that!

So is there a way to make minimal changes to my Apache configuration (e.g., just change the port 443 to something else) and then make HAProxy forward the connection to Apache if it's not SSH?

If you need any further details, please ask.

Improve this question

1 Answer 1

Reset to default
1

You must set apache on other port.

Internet-(443) ---- (443)-HAP-|-----(22) SSH

                          |-----(Other port ex 8443) apache

Else use sslh, work fine for https, ssh, xmpp.

Improve this answer
5
  • Thank you for your answer. I already mentioned that I need to change the port, but I don't want to change all my config. Besides, I don't want it to look like a man-in-the-middle attack. I like the idea that HAProxy encrypts the connection. Does sslh do that? If yes, then I'll proceed with it. I'm googling that right now.
    – The Quantum Physicist
    Mar 2, 2016 at 19:20
  • No, sslh just "look" the protocol, if is https, routing is done on the web server or ssh if the ssh. It is not necessary to generate a certificate because it is not acting as the MITM. HAProxy is a tool for high available web services, sslh when to him is clearly to use web and ssh server on the same port, it's Applicative protocol multiplexer
    – seb
    Mar 3, 2016 at 7:33
  • 1
    Actually while this sounds like a nice solution, it still can be detected by a good firewall. The nice thing about HAProxy and the solution I gave the link to is that it encrypts the ssh connection, which is absolutely undetectable!
    – The Quantum Physicist
    Mar 4, 2016 at 12:54
  • ssh is encrypted by its own means sslh just allows multiple services on a single port, it does not generated certificate to operate. I use it daily to access my ssh server from my work. If I switch to a browser that is the website that meets with apache. If I go through a SSH client (eg Putty) is the ssh service that answer. Another point, or the places I connect using proxy like squid and ssh is very stable.
    – seb
    Mar 7, 2016 at 16:17
  • 1
    I know ssh is encrypted. The point is not the encryption. The point is to masquerade ssh connection so that no one it knows it's ssh. Anyway I did that already and it's a success. I'm accepting your answer as helpful :)
    – The Quantum Physicist
    Mar 7, 2016 at 16:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .