Most active commenters

    ←back to thread

    SSH3: Faster and rich secure shell using HTTP/3

    (github.com)
    532 points tempaccount420 | 11 comments | 27 Sep 25 14:27 UTC | HN request time: 1.249s | source | bottom
    1. she46BiOmUerPVj ◴[27 Sep 25 15:27 UTC] No.45396551[source]▶
    So with HTTP requests you can see the domain name in the header and forward it to the correct host. That was never a thing you could do with SSH, does this allow that to work?
    replies(3): >>45396631 #>>45396916 #>>45397431 #
    2. billfor ◴[27 Sep 25 15:35 UTC] No.45396631[source]▶
    You can forward any ssh traffic based on the domain name with SNI redirection. You can also use that with, lets say the nginx stream module, to run ssh and http server on the same port.
    3. finaard ◴[27 Sep 25 16:00 UTC] No.45396916[source]▶
    But that wasn't really a thing that was an issue with SSH.

    Host *.internal.example.com

      ProxyCommand ssh -q -W %h:%p hop.internal.example.com
    in the SSH client config would make everything in that domain hop over that hop server. It's one extra connection - but with everything correctly configured that should be barely noticeable. Auth is also proxied through.
    replies(4): >>45397065 #>>45397084 #>>45397359 #>>45397400 #
    4. doubled112 ◴[27 Sep 25 16:13 UTC] No.45397065[source]▶
    If you don't need to do anything complicated, ProxyJump is easier to remember.

        Host *.internal.example.com
      ProxyJump hop.internal.example.com
    replies(1): >>45397175 #
    5. unsnap_biceps ◴[27 Sep 25 16:15 UTC] No.45397084[source]▶
    Newer versions of ssh support ProxyJump

      ssh -J hop.internal.example.com foo.internal.example.com
    6. chupasaurus ◴[27 Sep 25 16:24 UTC] No.45397175{3}[source]▶
    ProxyJump was implemented a decade ago to replace that specific string.
    7. she46BiOmUerPVj ◴[27 Sep 25 16:43 UTC] No.45397359[source]▶
    I'm aware of proxy jump and other client side config but I'd rather that not every single client need to do this configuration.
    8. kbolino ◴[27 Sep 25 16:47 UTC] No.45397400[source]▶
    Is there a way to configure the jump (hop) server to reroute the request based on the value of %h and/or %p? Otherwise, it's going to be quite difficult to configure something like HTTP virtual hosts.

    EDIT: Looking at the relevant RFC [1] and the OpenSSH sshd_config manual [2], it looks like the answer is that the protocol supports having the jump server decide what to do with the host/port information, but the OpenSSH server software doesn't present any relevant configuration knobs.

    [1]: https://www.rfc-editor.org/rfc/rfc4254.html#section-7.2

    [2]: https://man7.org/linux/man-pages/man5/sshd_config.5.html

    replies(1): >>45397636 #
    9. projektfu ◴[27 Sep 25 16:52 UTC] No.45397431[source]▶
    "Proxy jump

    "It is often the case that some SSH hosts can only be accessed through a gateway. SSH3 allows you to perform a Proxy Jump similarly to what is proposed by OpenSSH. You can connect from A to C using B as a gateway/proxy. B and C must both be running a valid SSH3 server. This works by establishing UDP port forwarding on B to forward QUIC packets from A to C. The connection from A to C is therefore fully end-to-end and B cannot decrypt or alter the SSH3 traffic between A and C."

    More or less, maybe but not automatically like you suggest, I think. I don't see why you couldn't configure a generic proxy to set it up, though.

    10. t-3 ◴[27 Sep 25 17:18 UTC] No.45397636{3}[source]▶
    Yes, but it's not in the sshd config, it's in the ssh config. See ssh_config(5), search for Remote to find the most relevant sections.
    replies(1): >>45405017 #
    11. kbolino ◴[28 Sep 25 15:23 UTC] No.45405017{4}[source]▶
    I don't follow. If it's in ssh_config, then it's client-side. Either that's the client initiating the request, in which case it's not server-controlled like HTTP virtual hosts, or else it's the "client" involved in the hop through the jump server, in which case it's going to be specific to a single username. Also the Remote* options have to do with remote port forwarding, which is in the wrong direction.

    What am I missing?