Name based SSH proxy

[Ángel González]

On 26/05/15 23:42, Kasper Dupont wrote:
>> >  I think the ProxyCommand Kasper ended up describing (checking for v6
>> >  connectivity or using a constrained HTTP CONNECT proxy) is a acceptable
>> >  way to go for people in the particular scenario he's concerned about.
> But it does not address all my requirements. I have a
> requirement that the hostname being used must be visible
> to the administrator of the SSH server. And it must be
> visible with minimal effort without requiring any software
> changes on the server.
>
> Sending the hostname in clear from proxy to server would
> address that concern.
>
> But there are not many opportunities for a proxy to inject
> data into the data stream from client to server without
> breaking integrity checks on the packets.
Why do you want the hostname being used to "be visible to the administrator
of the SSH server"?

I assumed you wanted to send the final hostname to the *proxying SSH 
server*.
In which case, you don't need such thing if using a HTTP CONNECT proxy (the
hostname is now given to the HTTP proxy). And if you use a ssh server 
like the ssh
tunneling I proposed, the final hostname is already provided, too.

If you want instead to give the hostname used to the *final* sshd, 
that's a different
requirement for which you provided no rationale (and I suspect you are 
not really
interested in).


Much more interesting at the final end than the requested would be to 
have the
original client IP (ie. X-Forwarded-For) but that would open a different 
can of worms
(and required software changes) about proxies whose forwarded IPs should 
be trusted.
Something I would prefer not to enter into.


A similar idea I had thought in the past was the ability to 
transparently forward a
connection after authentication to a different machine (after the 
PrivSep step, the
new sshd would be in a different host in the LAN). It differs from 
Kasper proxy in that
the proxy would be trusted (seen as the real machine from the outside).