# HAProxy SSH setup not working

**URL:** <https://discourse.haproxy.org/t/haproxy-ssh-setup-not-working/10227>\
**Category:** Help!\
**Created:** [September 12, 2024, 9:00pm UTC](https://discourse.haproxy.org/t/haproxy-ssh-setup-not-working/10227 "2024-09-12T21:00:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![iconoclasthero](https://avatars.discourse-cdn.com/v4/letter/i/43a26b/32.png) [@iconoclasthero](https://discourse.haproxy.org/u/iconoclasthero)\
**Post date:** [September 12, 2024, 9:00pm UTC](https://discourse.haproxy.org/t/haproxy-ssh-setup-not-working/10227/1 "2024-09-12T21:00:28Z")

</div>

Goal: to use HAProxy to provide port multiplexing including for SSH.  
Eventually, HAProxy will need to pass http/https 80/443 to nginx and I’ve gotten that to at least connect to the service it was supposed to.

I installed HAProxy 2.9.9 from the Ubuntu Oracular repo to get all the repo-packaged stuff like systemd files, logging, etc.

I compiled and installed HAProxy version 3.0.4-6cae9b-53 2024/09/10 on top of that.

* * *

With respect to SSH, I am following [Route SSH Connections with HAProxy (In-Depth Configuration)](https://www.haproxy.com/blog/route-ssh-connections-with-haproxy) but I cannot get it to work. Part of the problem is that I only have one backend SSH server so it doesn’t apply perfectly.

```auto
$ sshd --version
unknown option -- -
OpenSSH_9.7p1 Ubuntu-7ubuntu3, OpenSSL 3.3.1 4 Jun 2024

```

```auto
$ cat /etc/haproxy/haproxy.conf
global
	log /dev/log	local0 info	
	log /dev/log	local1 notice
	chroot /var/lib/haproxy
	stats socket /run/haproxy/admin.sock mode 660 level admin
	stats timeout 30s
	user haproxy
	group haproxy
	daemon

	# Default SSL material locations
	ca-base /etc/ssl/certs
	crt-base /etc/ssl/private

	# See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

defaults
	log	global
	mode	http
	option	httplog
#	mode	tcp
#	option	tcplog
	option	dontlognull
        timeout connect 5000
        timeout client 50000
        timeout server 50000
	errorfile 400 /var/log/haproxy/errors/400.http
	errorfile 403 /var/log/haproxy/errors/403.http
	errorfile 408 /var/log/haproxy/errors/408.http
	errorfile 500 /var/log/haproxy/errors/500.http
	errorfile 502 /var/log/haproxy/errors/502.http
	errorfile 503 /var/log/haproxy/errors/503.http
	errorfile 504 /var/log/haproxy/errors/504.http

frontend fe_ssh
   bind *:2222 ssl crt /etc/haproxy/certs/mydomainname.com.pem
# bind *:2222 ssl crt /etc/haproxy/certs/ssl.pem #created self-signed 2024.09.19
   mode tcp
   option tcplog
   log-format "%ci:%cp [%t] %ft %b/%s %Tw/%Tc/%Tt %B %ts %ac/%fc/%bc/%sc/%rc %sq/%bq dst:%[var(sess.dst)] "
   tcp-request content set-var(sess.dst) ssl_fc_sni
# use_backend %[ssl_fc_sni] #no connection to haproxy.
   use_backend ssh_backend

backend ssh_backend
    mode tcp
# server ssh1 127.0.0.1:22 check
# server ssh1 127.0.0.1:22 check ssl verify none # error: "haproxy[165452]: backend ssh_backend has no server available!"
    server ssh1 127.0.0.1:22 ssl verify none

```

so now when I try to connect to this using something like what the blog example:

```auto
ssh -o ProxyCommand="openssl s_client -quiet -connect ssh.mydomainname.com:2222 -servername ssh1" ssh
Connecting to 11.22.33.44
depth=2 C=US, O=Internet Security Research Group, CN=ISRG Root X1
verify return:1
depth=1 C=US, O=Let's Encrypt, CN=E5
verify return:1
depth=0 CN=mydomainname.com
verify return:1
Connection closed by UNKNOWN port 65535

```

systemctl/sshd reports this:

```auto
Sep 12 16:54:48 server sshd[165969]: banner exchange: Connection from 127.0.0.1 port 39668: invalid format

```

haproxy.log

```auto
2024-09-12T16:54:48.990339-04:00 server haproxy[165917]: 192.168.1.1:59638 [12/Sep/2024:16:54:45.933] fe_ssh~ ssh_backend/ssh1 5/-1/3056 0 SC 1/1/0/0/3 0/0 dst:ssh1 

```

I’m at a loss here to figure out what the blog makes it appear to be simple.

Guidance is appreciated.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [September 13, 2024, 7:36am UTC](https://discourse.haproxy.org/t/haproxy-ssh-setup-not-working/10227/2 "2024-09-13T07:36:41Z")

</div>

You MUST NOT enable SSL for your backend SSH server.

Your backend needs to look like this, no SSL configurations must be present here:

```
backend ssh_backend
 mode tcp
 server ssh1 127.0.0.1:22

```