RTFM · Healthchecks
lb.saphira.ssh: will it announce itself?
Before any key or password, an SSH server must announce its protocol version. This check reads that banner and requires SSH-2.0; credential-free by design, so it can never lock anything out.
What it proves
The server sends an SSH-2.0 protocol banner on connect. No authentication is attempted; deliberately: a health check that tried keys could trip rate limits, fail2ban, or audit logs. The banner is the server's own handshake and cannot be faked by a port-forward that only accepts TCP.
How it works
The probe engine's banner probe: connect, read the first bytes, match the regex. The default pattern is ^SSH-2\.0-; override with LB_SAPHIRA_SSH_BANNER if you need to pin a server flavour or tolerate a specific legacy version honestly ("named check = named capability" cuts both ways).
Configuration
| Variable | Default | Meaning |
|---|---|---|
| LB_SAPHIRA_SSH_BANNER | ^SSH-2\.0- | Banner regex the first read must match |
| LB_SAPHIRA_TIMEOUT | 3 | Banner deadline |
| (target port) | $4, else 22 | Any port an SSH server listens on |
Wiring it up
# ldirectord.cf - bastion pool
virtual = 203.0.113.10:22
protocol = tcp
scheduler = sh
real = 192.168.20.9:22 gate 1
real = 192.168.20.10:22 gate 1
checktype = external
checkcommand = "/var/lib/lb/saphira/lb.saphira.ssh"sh (source hash) keeps each operator's session on the same bastion; cheap connection affinity for interactive SSH.
Run it by hand
/var/lib/lb/saphira/lb.saphira.ssh bastion-pool 22 192.168.20.9 22
echo $?
# 0 = an SSH-2.0 banner arrived
# 1 = no banner, wrong protocol, or timeoutFailure modes
- TCP accepted, no banner; a tarpit, a broken TCP wrapper, or something that is not SSH on the port
- Banner but not SSH-2.0: an ancient server: fail loudly, upgrade it
Did we miss something?
If this page left something unanswered, found an error, or there is another subject you would like documented, tell us. Saphira’s documentation grows from real problems people need to solve.
Send feedback or request a new section →
Prefer not to do it yourself?
Everything needed to do the work yourself is documented here and remains free; we charge for human time, not for withholding knowledge. Sometimes the missing resource is simply time. The same people who build Saphira can provide paid professional help with implementation, migration, troubleshooting and administration.