Comment on OpenSSH 10.5/10.5p1Comments−qudat1moDarn, still no host headers so we can reverse proxy on a single ip−throw0101a1moDarn, still no host headers so we can reverse proxy on a single ipHow would this be done? After the "SSH-2.0" banner, the first packet is SSH_MSG_KEXINIT and there's no space in that for a "Host" header:* https://datatracker.ietf.org/doc/html/rfc4253#section-7.1−djmdjm1moIf we did this in SSH then I think we should do it properly and take inspiration from TLS ESNI https://datatracker.ietf.org/doc/draft-ietf-tls-esni/25/−stragies29dYou could wrap a TLS-connection around your SSH-connection, and then use the ALPN to indicate SSH, so that your reverse proxy knows, what to do with it.
Comments
Darn, still no host headers so we can reverse proxy on a single ip
How would this be done? After the "SSH-2.0" banner, the first packet is SSH_MSG_KEXINIT and there's no space in that for a "Host" header:
* https://datatracker.ietf.org/doc/html/rfc4253#section-7.1
If we did this in SSH then I think we should do it properly and take inspiration from TLS ESNI https://datatracker.ietf.org/doc/draft-ietf-tls-esni/25/
You could wrap a TLS-connection around your SSH-connection, and then use the ALPN to indicate SSH, so that your reverse proxy knows, what to do with it.