☰

带有 SSL ACL 的 haproxy multihost

tag-icon • tag-icon ssl haproxy
带有 SSL ACL 的 haproxy multihost

如何在 haproxy（1.5dev19）中为具有自己的 ssl 证书的多个服务器主机使用 ACL 规则？？

我有 3 个后端，且多个域都在一个 IP 地址上。

nodejs (http/https/ws/wss)

nginx (http/https)（现在是 apache 的反向代理）

阿帕奇 (http)

我想把 haproxy 放在它们前面并让它提供 ssl 连接。使用 haproxy acl 可行吗，或者我必须在 haproxy 前面使用像 stud 之类的东西？

就像是：

frontend http-in
    bind *:80

    acl host_domain1 hdr(host) -i domain1.lt
    use_backend nginx_web_http if host_domain1

frontend http-in
    bind *:443

    acl host_domain1 hdr(host) -i domain1.lt
    use_backend nginx_web_https if host_domain1

backend nginx_web_https
    mode http
    ssl crt /etc/ssl/domain1/ crt ./certs/ prefer-server-cipher
    option httplog
    option httpclose
    server nginx 192.168.2.101:8080 check

backend nginx_web_http
    mode http
    option httplog
    option httpclose
    server nginx 192.168.2.101:8080 check

答案1

我认为 haproxy 不会允许您为每个传入请求指定一个后端 SSL 证书，而是必须拥有一个允许多个域名（SNI）的组合证书。

以下是使用 SNI 和 haproxy 的指南，其中所有证书实际上都由 haproxy 服务器托管，而不是后端实例：https://trick77.com/haproxy-and-sni-based-ssl-offloading-with-intermediate-ca/

另请参阅本节末尾的示例：http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#4.2-使用服务器

答案2

实际上，您可以使用您的 haproxy 版本来执行此操作。我已在博客中介绍过这里

以下是示例：

global
   log 127.0.0.1  local0
   log 127.0.0.1  local1 notice
   #log loghost   local0 info
   maxconn 4096
   # chroot /usr/share/haproxy
   user haproxy
   group haproxy
   daemon
   #debug
   #quiet

defaults
   log   global
   mode  http
   option   httplog
   option   dontlognull
   retries  3
   option redispatch
   maxconn  2000
   contimeout  5000
   clitimeout  50000
   srvtimeout  50000

# Host HA-Proxy web stats on Port 3306 (that will confuse those script kiddies)
listen HAProxy-Statistics *:3306
    mode http
    option httplog
    option httpclose
    stats enable
    stats uri /haproxy?stats
    stats refresh 20s
    stats show-node
    stats show-legends
    stats show-desc Workaround haproxy for SSL
    stats auth admin:ifIruledTheWorld
    stats admin if TRUE

frontend ssl_relay 192.168.128.21:443
    # this only works with 1.5 haproxy
    mode tcp
    option tcplog
    option socket-stats
    # option nolinger
    maxconn  300

    # use tcp content accepts to detects ssl client and server hello.
    # acl clienthello req_ssl_hello_type 1 -> seems to not work

    tcp-request inspect-delay 5s
    tcp-request content accept if { req_ssl_hello_type 1 }

    use_backend ssl_testdomain_prod if { req_ssl_sni -i www.testdomain.nl }
    use_backend ssl_testdomain_stag if { req_ssl_sni -i test.testdomain.nl }

    default_backend ssl_testdomain_stag

backend ssl_testdomain_stag
   mode tcp
   #option nolinger
   option tcplog
   balance roundrobin
   hash-type consistent
   option srvtcpka

    # maximum SSL session ID length is 32 bytes.
    stick-table type binary len 32 size 30k expire 30m

    # make sure we cover type 1 (fallback)
    acl clienthello req_ssl_hello_type 1
    acl serverhello rep_ssl_hello_type 2

    # use tcp content accepts to detects ssl client and server hello.
    tcp-request inspect-delay 5s
    tcp-request content accept if clienthello

    # no timeout on response inspect delay by default.
    tcp-response content accept if serverhello

    # SSL session ID (SSLID) may be present on a client or server hello.
    # Its length is coded on 1 byte at offset 43 and its value starts
    # at offset 44.
    # Match and learn on request if client hello.
    stick on payload_lv(43,1) if clienthello

    # Learn on response if server hello.
    stick store-response payload_lv(43,1) if serverhello

    #option ssl-hello-chk

    server x_testdomain_stag 123.123.123.123:443


backend ssl_testdomain_prod
   mode tcp
   #option nolinger
   option tcplog
   balance roundrobin
   hash-type consistent
   option srvtcpka

    # maximum SSL session ID length is 32 bytes.
    stick-table type binary len 32 size 30k expire 30m

    # make sure we cover type 1 (fallback)
    acl clienthello req_ssl_hello_type 1
    acl serverhello rep_ssl_hello_type 2

    # use tcp content accepts to detects ssl client and server hello.
    tcp-request inspect-delay 5s
    tcp-request content accept if clienthello

    # no timeout on response inspect delay by default.
    tcp-response content accept if serverhello

    # SSL session ID (SSLID) may be present on a client or server hello.
    # Its length is coded on 1 byte at offset 43 and its value starts
    # at offset 44.
    # Match and learn on request if client hello.
    stick on payload_lv(43,1) if clienthello

    # Learn on response if server hello.
    stick store-response payload_lv(43,1) if serverhello

    #option ssl-hello-chk

    server x_testdomain_prod 123.123.111.111:443

这个例子意味着您在 web 服务器后端终止您的 SSL，我还没有尝试使用 haproxy ssl 终止来执行此操作。

如果这就是您想要的，也许这个例子可以帮助您实现它。

还有另一个示例使用 use_server 而不是 use_backend这里

相关内容