mirror of https://github.com/moparisthebest/sslh
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
87 lines
3.2 KiB
87 lines
3.2 KiB
# This file is provided as documentation to show what is |
|
# possible. It should not be used as-is, and probably should |
|
# not be used as a starting point for a working |
|
# configuration. Instead use basic.cfg. |
|
|
|
verbose: true; |
|
foreground: true; |
|
inetd: false; |
|
numeric: false; |
|
transparent: false; |
|
timeout: "2"; |
|
user: "nobody"; |
|
pidfile: "/var/run/sslh.pid"; |
|
|
|
|
|
# List of interfaces on which we should listen |
|
listen: |
|
( |
|
{ host: "thelonious"; port: "443"; }, |
|
{ host: "thelonious"; port: "8080"; } |
|
); |
|
|
|
# List of protocols |
|
# |
|
# Each protocol entry consists of: |
|
# name: name of the probe. These are listed on the command |
|
# line (ssh -?), plus 'regex' and 'timeout'. |
|
|
|
# service: (optional) libwrap service name (see hosts_access(5)) |
|
# host, port: where to connect when this probe succeeds |
|
# |
|
# Probe-specific options: |
|
# tls: |
|
# sni_hostnames: list of FQDN for that target |
|
# alpn_protocols: list of ALPN protocols for that target, see: |
|
# https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids |
|
# |
|
# if both sni_hostnames AND alpn_protocols are specified, both must match |
|
# if neither are set, it is just checked whether this is the TLS protocol or not |
|
# regex: |
|
# regex_patterns: list of patterns to match for |
|
# that target. |
|
# |
|
# sslh will try each probe in order they are declared, and |
|
# connect to the first that matches. |
|
# |
|
# You can specify several of 'regex' and 'tls'. |
|
|
|
protocols: |
|
( |
|
{ name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; }, |
|
{ name: "http"; host: "localhost"; port: "80"; }, |
|
|
|
# match BOTH ALPN/SNI |
|
{ name: "tls"; host: "localhost"; port: "5223"; alpn_protocols: [ "xmpp-client" ]; sni_hostnames: [ "im.somethingelse.net" ]; log_level: 0;}, |
|
|
|
# just match ALPN |
|
{ name: "tls"; host: "localhost"; port: "443"; alpn_protocols: [ "h2", "http/1.1", "spdy/1", "spdy/2", "spdy/3" ]; log_level: 0; }, |
|
{ name: "tls"; host: "localhost"; port: "xmpp-client"; alpn_protocols: [ "xmpp-client" ]; log_level: 0;}, |
|
|
|
# just match SNI |
|
{ name: "tls"; host: "localhost"; port: "993"; sni_hostnames: [ "mail.rutschle.net", "mail.englishintoulouse.com" ]; log_level: 0; }, |
|
{ name: "tls"; host: "localhost"; port: "xmpp-client"; sni_hostnames: [ "im.rutschle.net", "im.englishintoulouse.com" ]; log_level: 0;}, |
|
|
|
# catch anything else TLS |
|
{ name: "tls"; host: "localhost"; port: "443"; }, |
|
|
|
# OpenVPN |
|
{ name: "regex"; host: "localhost"; port: "1194"; regex_patterns: [ "^\x00[\x0D-\xFF]$", "^\x00[\x0D-\xFF]\x38" ]; }, |
|
# Jabber |
|
{ name: "regex"; host: "localhost"; port: "5222"; regex_patterns: [ "jabber" ]; }, |
|
|
|
# Catch-all |
|
{ name: "regex"; host: "localhost"; port: "443"; regex_patterns: [ "" ]; }, |
|
|
|
# Where to connect in case of timeout (defaults to ssh) |
|
{ name: "timeout"; service: "daytime"; host: "localhost"; port: "daytime"; } |
|
); |
|
|
|
# Optionally, specify to which protocol to connect in case |
|
# of timeout (defaults to "ssh"). |
|
# You can timeout to any arbitrary address by setting an |
|
# entry in 'protocols' named "timeout". |
|
# This enables you to set a tcpd service name for this |
|
# protocol too. |
|
on-timeout: "timeout"; |
|
|
|
|