Forum Discussion
CirrostratusSSH proxy implementation
Hi , my scenario is -
users need to connect to sftp server - via F5 -
F5 has snat so sftp server cannot see real ip of users .
i need to implement an allow list of username + client ip on F5 .
on F5 i can see client IP - and if i implement ssh proxy - can i get username as well?
thanks
3 Replies
Hi,
You can restrict commands per username in the SSH proxy: SSH-ProxyBut it is not possible to restrict a client ip/username combination.
I think you best chance is with an irule and data group, see this example: irule-to-pass-original-client-ip-in-ssh-proxyCheers,
Kees
awan_mThnaks for the response
Question - once i setup ssh proxy and it has the option to allow commands for users
would i be able to log users - and then i can do a compare from datagroup and allow ip / user connections- awan_m
i have ssh proxy configured now - and ssh proxy is logging client ip and username
"ssh_serverside_auth_success","10.10.10.10","puser"
now the task how can i extract this information and compare it against a data groupwith SSL - there are irule options to extract info with CLIENTSSL_DATA
how can i extract the username from ssh proxy ?thanks
