#SSH PROXY HOST OFFLINE#

Two semesters in and the load balancing server is doing great.

Not shown here, we also use zabbix ( n) and grafana to make a pretty dashboard showing connections to HAProxy vs time, so we can see how the service is used during the week.

Try telnet hostname 22 to see what your sshd prints. The tcp-check line means it is looking for a string that starts with SSH-2.0-OpenSSH when checking if the ssh service is up on each host.

#SSH PROXY HOST OFFLINE#

For each server line, the check inter 10s fall 2 rise 1 part controls how HAProxy checks (every 10 sec) for offline (2 failed checks) and online (1 successful check) hosts.We set the timeouts to 36 hours, since students sometimes set up long-running (overnight) jobs, and we figured they would check back in on them after 12-24 hours.# lots more hosts here (we currently have 42 hosts in here)Д«ind *:443 ssl crt /etc/letsencrypt/live//haproxy.pem Server hostC 1.2.3.12:22 check inter 10s fall 2 rise 1 Server hostB 1.2.3.11:22 check inter 10s fall 2 rise 1 Server hostA 1.2.3.10:22 check inter 10s fall 2 rise 1 Tcp-check expect rstring SSH-2.0-OpenSSH.* Stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listenersД®rrorfile 400 /etc/haproxy/errors/400.httpД®rrorfile 403 /etc/haproxy/errors/403.httpД®rrorfile 408 /etc/haproxy/errors/408.httpД®rrorfile 500 /etc/haproxy/errors/500.httpД®rrorfile 502 /etc/haproxy/errors/502.httpД®rrorfile 503 /etc/haproxy/errors/503.httpД®rrorfile 504 /etc/haproxy/errors/504.http You probably want to put all of these ssh host pub keys in a /etc/ssh/ssh_known_hosts2 file, and distribute it to all of your lab computersДЇor example, hereвЂ™s a simplified section of our ssh_known_hosts2 file (with fake names and IP addresses), only showing one of the key types (ed25519) for each host:.Set up the same ssh host keys for all of the lab computers you want in the load-balancing rotation, otherwise your users will get WARNING SSH HOST KEY CHANGED messages each time they get sent to a different computer.Also set up sshd on the HAProxy server to run on a different port (we use Port 9000 in /etc/ssh/sshd_config) so your admins can still get to it ( ssh -p 9000 ).Set up HAProxy to bind to port 22 (see the listen ssh part of the config file below).Nobody actually logs in to the HAProxy server except admins, so you donвЂ™t need to set up student accounts on the HAProxy server.

One server (we use debian) runs HAProxy (v1.8.19) and has the hostname you want the students to use when connecting (e.g., ssh ).

Additionally, if any computers happen to reboot or be down, we wanted them automatically (and quickly) removed from the load-balancing rotation, and put back into the rotation when they were up again. To make this easy for students, we used one address (e.g., ) that students could ssh to, which would load-balance the ssh connections across our various lab computers. The former now especially relevant as our institution had halved the number of students on campus and eliminated in person computer lab access as a response to the pandemic. This is an especially popular feature for students who either (1) arenвЂ™t on campus or (2) want to work from elsewhere on campus. To access the lab computers remotely, students ssh in. These 100 or so lab computers are spread out over the various lab locations on campusвЂ“all of which that run linux. The Swarthmore CS department maintains our own servers ( i.e., dns, web, email, ldap, etc) and lab computers. This page is a modified mirror of JeffвЂ™s page that describes our setup.

I completed this project in partnership with my CS DepartmentвЂ™s wonderful Sysadmin Jeff Knerr. One of the many things I did last summer (2020) was set up a up HAProxy as a load-balancer for my CS departmentвЂ™s incoming ssh connections.

Ssh proxy host