Re: load balancing ssh

Hi,
One thing to consider is the alert message that could got the client=20
(depend the setting) when accessing different host/key with same IPs.=20
Never did that with LB, but did something similar for a VIP cluster ssh=20
solution. Maybe you should googled with SSH and Cluster VIP.

Maybe you can have the same hosts key on all hosts of the farm, you will=20
then avoid having the client which goes to the VIP of the LB having a=20
mismatch of the host key, but this could not be a good security practice=20
or you will need to have the host-key security check disable.

Kind Regards,
Pascal

Le 12.03.11 00:57, Leo Schubert a =E9crit :
> Hi,
> any suggestions/pointers what are the best practices in load balancing=20
> ssh ?
> I googled quite heavy for it and found a lot of general purpose load=20
> balancer systems/software
> (LVS, balance(NG) , HAProxy) but didn't get too much information how=20
> to apply it to ssh.
> Im especially interested in the security aspect that a load balancer=20
> act's as a "man in the middle" and at the client side one gets=20
> permanently potential host key changes if the balancer directs to=20
> another real host than in the previous connection. Are there also=20
> other security aspects I should be aware of if I simply use a tool=20
> like "balance" to multiplex incoming requests on a decicated device to=20
> multiple hosts ?
> Kind Regards, Leo
>