Documentation
Open Source Release Policy
Export Compliance
Using BouncyCastle
Installing the API
Enabling Logging
Per-Connection Logging
Third Party Dependencies
Generating SSH Keys
Using BouncyCastle
Using SSH Public Keys in Java
Supporting ED25519/Curve25519
Supporting Compression
Integrating Licensing into Maven Builds
Creating an SSH Client
Public Key Authentication
Keyboard Interactive Authentication
Public Key Authentication with sshagent
Executing Single Commands
Executing Commands within a Shell
Transferring Files
Connecting through Proxies
Display the Authentication Banner
Using the SFTP Client
Port Forwarding
Working Examples
Configuring Listening Interfaces
Configuring Host Keys
Password Authentication
Public Key Authentication
Challenge-Response Authentication
Configuring Port Forwarding
Configuring SFTP
Supporting SCP
Implementing your own File System
Creating an Interactive Terminal
Proxy Protocol Support
Introduction
The Maverick Synergy Server supports the PROXY protocol V1 for updating client IP addresses when the server is deployed behind a supporting load balancer. When enabled, the load balancer can send the PROXY directive to provide the server with the current connections’ external IP address. This ensures that features that rely on the user’s IP address function correctly in a load-balanced environment.
Configuration
As of version 3.0.8, the protocol is disabled by default. If you are using 3.0.7, you should upgrade as it could potentially lead to a user spoofing their IP address.
To enable support, you should first configure your SshContext
sshContext.getPolicy(LoadBalancer.class).setProxyProtocolEnabled(true);Code language: CSS (css)This will enable restricted support; it is not enough to use this alone. You should also supply the IP addresses of servers that may submit the proxy protocol directive.
sshContext.getPolicy(LoadBalancer.class).allowIPAddress("192.168.2.9");Code language: CSS (css)If your server is sufficiently protected and only supports connections from your load balancers, you can disable the IP restriction using the code instead.
sshContext.getPolicy(LoadBalancer.class).setRestrictedAccess(false);Code language: CSS (css)