Skip to content
Tech News
← Back to articles

SSH has no Host header

read original get SSH Key Management Kit → more articles
Why This Matters

This article highlights a novel approach to managing SSH connections for multiple virtual machines sharing IPv4 addresses by leveraging unique IP assignments and user-specific public keys. This solution addresses the challenge of routing SSH traffic without the Host header, similar to web traffic, enabling cost-effective VM management at scale. It underscores the importance of innovative network routing techniques in optimizing cloud infrastructure and resource allocation.

Key Takeaways

We have a challenge with ssh. Every VM has a standard URL that we use for both HTTPS and SSH, e.g. undefined-behavior.exe.xyz . Just as you can type the domain into a web browser (and have TLS and auth taken care of for you), you can run:

ssh undefined-behavior.exe.xyz

To get a shell in your VM.

This is very straightforward to implement if you give each machine its own IP address, but exe.dev gives you many VMs on a flat rate subscription.

We cannot issue an IPv4 address to each machine without blowing out the cost of the subscription. We cannot use IPv6-only as that means some of the internet cannot reach the VM over the web. That means we have to share IPv4 addresses between VMs.

For the web, this is a long-solved problem. Many sites can and do have the same IP address. Web browsers send the domain they used to reach the server in the HTTP request as the Host header. The exe.dev proxy switches on this header and send requests to the appropriate VM.

SSH, on the other hand, has no equivalent of a Host header. If we reuse IPv4 addresses between VMs, we have no way to send SSH connections to the right VM.

How we solved this: SSH IP sharing

Instead of using one IP address for all VMs, we have a pool of public IPv4 addresses. Each VM is assigned a unique address relative to its owner.

So instead of an A record, you will find

... continue reading