Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH has no Host header

blog.exe.dev

Post reply on HN
Print view View original

141–150 of 181 posts

Re: SSH has no Host header

#141

Post by kazinator »

> SSH, on the other hand, has no equivalent of a Host header.

SSH cannot multiplex to different servers on the same host:port. But you can use multiple ports and forwarding.

You could give each machine a port number instead of a host name:

   ssh-proxy:10001
   ssh-proxy:10002
When you ssh to "ssh-proxy:10002" ("ssh -p 10002 ssh-proxy" wth your OpenSSH client that doesn't take host:port, sigh), it forwards that to wherever the 10002 machine currently is.

It would be interesting to know why they rejected the port number solution, but the only hit for "port" in the article is in the middle of the word "important" in the sentence:

But uniform, predictable domain name behavior is important to us, so we took the time to build this for exe.dev.

You can have uniform, predictable domain + port behavior. Then you don't need a smart proxy which routes connections based on identities like public keys. Just manipulation of standard port forwarding (e.g. iptables).

Re: SSH has no Host header

#142

Post by apitman »

crawshaw wrote: post #133
apitman wrote: post #132

Earlier quoted context omitted.

Yep. As sad as it is for p2p, NAT handles most uses cases for users, and SNI routing (or creative hacks like OP) handles most use cases for providers. I was surprised how low IPv4 prices have gotten. Lowest since at least 2019.

Amazingly even most p2p works with NAT, see (and I am biased here) Tailscale. I certainly wish we simply had more addresses. But v4 works.

Your NAT traversal article is amazing, but sadly the long tail (ha) means any production quality solution has to have relays, which is a huge complexity jump for people who just want to run some p2p app on their laptop.

And it's not clear it will ever be better than it is now with CGNAT on the rise.

Would love to hear I'm wrong about this.

Re: SSH has no Host header

#144

Post by gsich »

otterley wrote: post #17
gsich wrote: post #16

Earlier quoted context omitted.

Middleboxes are not relevant in this scenario.

Uh, why not? Unless your SSH client is on the same network as theirs, there are going to be middleboxes somewhere in the path.

Because your ISP should (and most do not) alter traffic.

Re: SSH has no Host header

#145

Post by bombcar »

bfivyvysj wrote: post #94
lmm wrote: post #29

Earlier quoted context omitted.

The point is that they want the simple UX of "ssh vm1.box1.tld" takes you to the same machine that browsing to vm1.box1.tld takes you to, without requiring their users to set any additional configuration.

You can have that already? It's just dns. Are you saying different vms share the same box1 ip? Well then yeah, you want a reverse proxy on some shared ip.

I wonder if SSH supports SRV records and if it would help.

Re: SSH has no Host header

#146

Post by bombcar »

hnarn wrote: post #135

There are about 60k ports you can choose from for each IP, so I don’t understand why you can’t just give one user 1.2.3.4:1001 and the other 1.2.3.4:1002 and route that. Setting it up like this where you just assume: > The public key tells us the user, and the {user, IP} tuple uniquely identifies the VM they are connecting to. Seems like begging for future architectural problems.

Something like getting SSH to support SRV records would allow that to be transparent to the user: https://github.com/Crosse/sshsrv

Re: SSH has no Host header

#147

Post by arcfour »

dlenski wrote: post #3

SSH is an incredibly versatile and useful tool, but many things about the protocol are poorly designed , including its essentially made-up-as-you-go-along wire formats for authentication negotiation, key exchange, etc. In 2024-2025, I did a survey of millions of public keys on the Internet, gathered from SSH servers and users in addition to TLS hosts, and discovered—among other problems—that it's incredibly easy to m…

SSH does have a certificate format that can place restrictions on what the user can do when connecting with that key. I'm not so sure about the hostkey side of things though.

For example: https://smallstep.com/blog/ssh-vs-x509-certificates/#certifi... you can see here that X11 forwarding is permitted for this certificate, among other things.

Re: SSH has no Host header

#148

Post by Imustaskforhelp »

crawshaw wrote: post #127
miyuru wrote: post #25

> We cannot issue an IPv4 address to each machine without blowing out the cost of the subscription. We cannot use IPv6-only as that means some of the internet cannot reach the VM over the web. That means we have to share IPv4 addresses between VMs. Give a user a option for use IPv6 only, and if the user need legacy IP add it as a additional cost and move on. Trying to keep v4 at the same cost level as v6 is not a thi…

(exe.dev co-founder here) IPv6 does not work on the only ISP in my neighborhood that provides gigabit links. I will not build a product I cannot use. Even when IPv6 is rolled out, it is only tested for consumer links by Happy Eyeballs. Links between DCs are entirely IPv4 even when dual stacked. We just discovered 20 of our machines in an LAX DC have broken IPv6 (because we tried to use Tailscale to move data to them,…

Have you looked at each service running through a cloudflare tunnel or (HE offers something similar too)?

(PS: I use exe.dev quite a lot whenever I want to have a project and basic scripting doesn't work and I want to have a full environment, really thanks for having this product I really appreciate it as someone who has been using it since day one and have recommended/talked about your service in well regards to people :>)

Re: SSH has no Host header

#149

Post by doubled112 »

rwmj wrote: post #104
_cenw wrote: post #53

Earlier quoted context omitted.

This is great if you have IPv6 support from your ISP. Not so great if you don't. Before someone mentions tunnels: Last time I tried to set up a tunnel Happy Eyeballs didn't work for me at all; almost everything went through the tunnel anyway and I had to deal with non-residential IP space issues and way too much traffic.

Are there really ISPs that don't support IPv6? I've had IPv6 from various ISPs since around 2010, and even my phone gets an IPv6 address from the cellular network.

Bell Canada does not provide IPv6 to Internet customers but their cell network does support it. They're one of what we call "the big three".

https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...

Looks like Canada has roughly 40% adoption, and USA roughly 50% adoption.

Re: SSH has no Host header

#150

Post by kiwijamo »

rwmj wrote: post #104
_cenw wrote: post #53

Earlier quoted context omitted.

This is great if you have IPv6 support from your ISP. Not so great if you don't. Before someone mentions tunnels: Last time I tried to set up a tunnel Happy Eyeballs didn't work for me at all; almost everything went through the tunnel anyway and I had to deal with non-residential IP space issues and way too much traffic.

Are there really ISPs that don't support IPv6? I've had IPv6 from various ISPs since around 2010, and even my phone gets an IPv6 address from the cellular network.

It varies in different parts of the world. Here in New Zealand all except one fixed line (i.e. fibre/xDSL) provider offers IPv6 (the only hold out being the ex-government telco). Wireless/mobile (4G/5G mobile or FWA) is a different story however as all wireless/mobile networks are IPv4 only still to this day (even thogh two of them are also fixed line providers offering IPv6 via their fixed line service!).
Post reply on HN