mirror of
https://github.com/moparisthebest/sslh
synced 2024-11-12 04:05:05 -05:00
f842e2e081
Corrected OpenVPN probe to support pre-shared secret mode (OpenVPN port-sharing code is... wrong). Thanks to Kai Ellinger for help in investigating and testing. Added an actual TLS/SSL probe. Added configurable --on-timeout protocol specification. Added a --anyprot protocol probe (equivalent to what --ssl was). Makefile respects the user's compiler and CFLAG choices (falling back to the current values if undefined), as well as LDFLAGS. (Michael Palimaka) Added "After" and "KillMode" to systemd.sslh.service (Thomas Weißschuh). Added LSB tags to etc.init.d.sslh (Thomas Varis).
220 lines
6.7 KiB
Plaintext
220 lines
6.7 KiB
Plaintext
# I'm just not gonna write troff :-)
|
|
|
|
=head1 NAME
|
|
|
|
sslh - protocol demultiplexer
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
sslh [B<-F> I<config file>] [ B<-t> I<num> ] [B<-p> I<listening address> [B<-p> I<listening address> ...] [B<--ssl> I<target address for SSL>] [B<--ssh> I<target address for SSH>] [B<--openvpn> I<target address for OpenVPN>] [B<--http> I<target address for HTTP>] [B<--anyprot> I<default target address>] [B<--on-timeout> I<protocol name>] [B<-u> I<username>] [B<-P> I<pidfile>] [-v] [-i] [-V] [-f] [-n]
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
B<sslh> accepts connections on specified ports, and forwards
|
|
them further based on tests performed on the first data
|
|
packet sent by the remote client.
|
|
|
|
Probes for HTTP, SSL, SSH, OpenVPN, tinc, XMPP are
|
|
implemented, and any other protocol that can be tested using
|
|
a regular expression, can be recognised. A typical use case
|
|
is to allow serving several services on port 443 (e.g. to
|
|
connect to ssh from inside a corporate firewall, which
|
|
almost never block port 443) while still serving HTTPS on
|
|
that port.
|
|
|
|
Hence B<sslh> acts as a protocol demultiplexer, or a
|
|
switchboard. Its name comes from its original function to
|
|
serve SSH and HTTPS on the same port.
|
|
|
|
=head2 Libwrap support
|
|
|
|
One drawback of B<sslh> is that the servers do not see the
|
|
original IP address of the client anymore, as the connection
|
|
is forwarded through B<sslh>.
|
|
|
|
For this reason, B<sslh> can be compiled with B<libwrap> to
|
|
check accesses defined in F</etc/hosts.allow> and
|
|
F</etc/hosts.deny>. Libwrap services can be defined using
|
|
the configuration file.
|
|
|
|
=head2 Configuration file
|
|
|
|
A configuration file can be supplied to B<sslh>. Command
|
|
line arguments override file settings. B<sslh> uses
|
|
B<libconfig> to parse the configuration file, so the general
|
|
file format is indicated in
|
|
L<http://www.hyperrealm.com/libconfig/libconfig_manual.html>.
|
|
Please refer to the example configuration file provided with
|
|
B<sslh> for the specific format (Options have the same names
|
|
as on the command line, except for the list of listen ports
|
|
and the list of protocols).
|
|
|
|
The configuration file makes it possible to specify
|
|
protocols using regular expressions: a list of regular
|
|
expressions is given as the I<probe> parameter, and if the
|
|
first packet received from the client matches any of these
|
|
expressions, B<sslh> connects to that protocol.
|
|
|
|
Alternatively, the I<probe> parameter can be set to
|
|
"builtin", to use the compiled probes which are much faster
|
|
than regular expressions.
|
|
|
|
=head2 Probing protocols
|
|
|
|
When receiving an incoming connection, B<sslh> will read the
|
|
first bytes sent be the connecting client. It will then
|
|
probe for the protocol in the order specified on the command
|
|
line (or the configuration file). Therefore B<--anyprot>
|
|
should alway be used last, as it always succeeds and further
|
|
protocols will never be tried.
|
|
|
|
If no data is sent by the client, B<sslh> will eventually
|
|
time out and connect to the protocol specified with
|
|
B<--on-timeout>, or I<ssh> if none is specified.
|
|
|
|
=head1 OPTIONS
|
|
|
|
=over 4
|
|
|
|
=item B<-t> I<num>, B<--timeout> I<num>
|
|
|
|
Timeout before forwarding the connection to the timeout
|
|
protocol (which should usually be SSH). Default is 2s.
|
|
|
|
=item B<--on-timeout> I<protocol name>
|
|
|
|
Name of the protocol to connect to after the timeout period
|
|
is over. Default is 'ssh'.
|
|
|
|
=item B<-p> I<listening address>, B<--listen> I<listening address>
|
|
|
|
Interface and port on which to listen, e.g. I<foobar:443>,
|
|
where I<foobar> is the name of an interface (typically the
|
|
IP address on which the Internet connection ends up).
|
|
|
|
This can be specified several times to bind B<sslh> to
|
|
several addresses.
|
|
|
|
=item B<--ssl> I<target address>
|
|
=item B<--tls> I<target address>
|
|
|
|
Interface and port on which to forward SSL connection,
|
|
typically I<localhost:443>.
|
|
|
|
Note that you can set B<sslh> to listen on I<ext_ip:443> and
|
|
B<httpd> to listen on I<localhost:443>: this allows clients
|
|
inside your network to just connect directly to B<httpd>.
|
|
|
|
Also, B<sslh> probes for SSLv3 (or TLSv1) handshake and will
|
|
reject connections from clients requesting SSLv2. This is
|
|
compliant to RFC6176 which prohibits the usage of SSLv2. If
|
|
you wish to accept SSLv2, use B<--default> instead.
|
|
|
|
=item B<--ssh> I<target address>
|
|
|
|
Interface and port on which to forward SSH connections,
|
|
typically I<localhost:22>.
|
|
|
|
=item B<--openvpn> I<target address>
|
|
|
|
Interface and port on which to forward OpenVPN connections,
|
|
typically I<localhost:1194>.
|
|
|
|
=item B<--xmpp> I<target address>
|
|
|
|
Interface and port on which to forward XMPP connections,
|
|
typically I<localhost:5222>.
|
|
|
|
=item B<--http> I<target address>
|
|
|
|
Interface and port on which to forward HTTP connections,
|
|
typically I<localhost:80>.
|
|
|
|
=item B<--tinc> I<target address>
|
|
|
|
Interface and port on which to forward tinc connections,
|
|
typically I<localhost:655>.
|
|
|
|
This is experimental. If you use this feature, please report
|
|
the results (even if it works!)
|
|
|
|
=item B<--anyprot> I<target address>
|
|
|
|
Interface and port on which to forward if no other protocol
|
|
has been found. Because B<sslh> tries protocols in the order
|
|
specified on the command line, this should be specified
|
|
last. If no default is specified, B<sslh> will forward
|
|
unknown protocols to the first protocol specified.
|
|
|
|
=item B<-v>, B<--verbose>
|
|
|
|
Increase verboseness.
|
|
|
|
=item B<-n>, B<--numeric>
|
|
|
|
Do not attempt to resolve hostnames: logs will contain IP
|
|
addresses. This is mostly useful if the system's DNS is slow
|
|
and running the I<sslh-select> variant, as DNS requests will
|
|
hang all connections.
|
|
|
|
=item B<-V>
|
|
|
|
Prints B<sslh> version.
|
|
|
|
=item B<-u> I<username>, B<--user> I<username>
|
|
|
|
Requires to run under the specified username.
|
|
|
|
=item B<-P> I<pidfile>, B<--pidfile> I<pidfile>
|
|
|
|
Specifies a file in which to write the PID of the main
|
|
server.
|
|
|
|
=item B<-i>, B<--inetd>
|
|
|
|
Runs as an I<inetd> server. Options B<-P> (PID file), B<-p>
|
|
(listen address), B<-u> (user) are ignored.
|
|
|
|
=item B<-f>, B<--foreground>
|
|
|
|
Runs in foreground. The server will not fork and will remain connected
|
|
to the terminal. Messages normally sent to B<syslog> will also be sent
|
|
to I<stderr>.
|
|
|
|
=item B<--background>
|
|
|
|
Runs in background. This overrides B<foreground> if set in
|
|
the configuration file (or on the command line, but there is
|
|
no point setting both on the command line unless you have a
|
|
personality disorder).
|
|
|
|
=back
|
|
|
|
=head1 FILES
|
|
|
|
=over 4
|
|
|
|
=item F</etc/init.d/sslh>
|
|
|
|
Start-up script. The standard actions B<start>, B<stop> and
|
|
B<restart> are supported.
|
|
|
|
=item F</etc/default/sslh>
|
|
|
|
Server configuration. These are environment variables
|
|
loaded by the start-up script and passed to B<sslh> as
|
|
command-line arguments. Refer to the OPTIONS section for a
|
|
detailed explanation of the variables used by B<sslh>.
|
|
|
|
=back
|
|
|
|
=head1 SEE ALSO
|
|
|
|
Last version available from
|
|
L<http://www.rutschle.net/tech/sslh>, and can be tracked
|
|
from L<http://freecode.com/projects/sslh>.
|
|
|
|
=head1 AUTHOR
|
|
|
|
Written by Yves Rutschle
|