git ssb

1
# This file is provided as documentation to show what is
2
# possible. It should not be used as-is, and probably should
3
# not be used as a starting point for a working
4
# configuration. Instead use basic.cfg.
5
6
verbose: true;
7
foreground: true;
8
inetd: false;
9
numeric: false;
10
transparent: false;
11
timeout: 2;
12
user: "nobody";
13
pidfile: "/var/run/sslh.pid";
14
15
16
# List of interfaces on which we should listen
17
# Options:
18
listen:
19
(
20
    { host: "thelonious"; port: "443"; },
21
    { host: "thelonious"; port: "8080"; keepalive: true; }
22
);
23
24
# List of protocols
25
#
26
# Each protocol entry consists of:
27
#   name: name of the probe. These are listed on the command
28
#   line (ssh -?), plus 'regex' and 'timeout'.
29
30
#   service: (optional) libwrap service name (see hosts_access(5))
31
#   host, port: where to connect when this probe succeeds
32
#   log_level:  0 to turn off logging
33
#               1 to log each incoming connection
34
#   keepalive:  Should TCP keepalive be on or off for that
35
#               connection (default is off)
36
#
37
#  Probe-specific options:
38
#       tls:
39
#               sni_hostnames:  list of FQDN for that target
40
#               alpn_protocols: list of ALPN protocols for that target, see:
41
#               https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids
42
#
43
#               if both sni_hostnames AND alpn_protocols are specified, both must match
44
#               if neither are set, it is just checked whether this is the TLS protocol or not
45
#       regex:
46
#               regex_patterns: list of patterns to match for
47
#               that target.
48
#   
49
# sslh will try each probe in order they are declared, and
50
# connect to the first that matches.
51
#
52
# You can specify several of 'regex' and 'tls'.
53
 
54
protocols:
55
(
56
     { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; keepalive: true; },
57
     { name: "http"; host: "localhost"; port: "80"; },
58
59
# match BOTH ALPN/SNI
60
     { name: "tls"; host: "localhost"; port: "5223"; alpn_protocols: [ "xmpp-client" ]; sni_hostnames: [ "im.somethingelse.net" ]; log_level: 0;},
61
62
# just match ALPN
63
     { name: "tls"; host: "localhost"; port: "443"; alpn_protocols: [ "h2", "http/1.1", "spdy/1", "spdy/2", "spdy/3" ]; log_level: 0; },
64
     { name: "tls"; host: "localhost"; port: "xmpp-client"; alpn_protocols: [ "xmpp-client" ];  log_level: 0;},
65
66
# just match SNI
67
     { name: "tls"; host: "localhost"; port: "993"; sni_hostnames: [ "mail.rutschle.net", "mail.englishintoulouse.com" ]; log_level: 0; },
68
     { name: "tls"; host: "localhost"; port: "xmpp-client"; sni_hostnames: [ "im.rutschle.net", "im.englishintoulouse.com" ];  log_level: 0;},
69
70
# catch anything else TLS
71
     { name: "tls"; host: "localhost"; port: "443"; },
72
73
# OpenVPN
74
     { name: "regex"; host: "localhost"; port: "1194"; regex_patterns: [ "^\x00[\x0D-\xFF]$", "^\x00[\x0D-\xFF]\x38" ]; },
75
# Jabber
76
     { name: "regex"; host: "localhost"; port: "5222"; regex_patterns: [ "jabber" ]; },
77
78
# Catch-all
79
     { name: "regex"; host: "localhost"; port: "443"; regex_patterns: [ "" ]; },
80
81
# Where to connect in case of timeout (defaults to ssh)
82
     { name: "timeout"; service: "daytime"; host: "localhost"; port: "daytime"; }
83
);
84
85
# Optionally, specify to which protocol to connect in case
86
# of timeout (defaults to "ssh").
87
# You can timeout to any arbitrary address by setting an
88
# entry in 'protocols' named "timeout".
89
# This enables you to set a tcpd service name for this
90
# protocol too.
91
on-timeout: "timeout";
92
93