I’ve replaced the NGINX HTTP reverse proxy with an HAProxy HA pair that now handles both HTTP reverse proxy and SSH proxy through a single floating VIP.
Unit testing was successful without MFA. After enabling MFA on the brokers, both the web browser client and the native ThinLinc client are able to authenticate with MFA and establish sessions successfully via the VIP
For HTTP persistence I’m currently using source (source IP), similar to how we’d configure persistence on a NetScaler ADC. Initial testing looks promising, although getting everything working took a bit of effort.
At the moment it’s only configured for HTTP browser access and SSH and all testing has been carried out on the LAN. Further unit testing is required.
Before moving on to stage 2—enabling HTTPS on the HAProxy, installing certificates, configuring HSTS, cipher suites, TLS settings, etc. (essentially treating it like a NetScaler ADC gateway)—is there anything I should be aware of or any recommended best practices specific to ThinLinc?
Update:
HTTPS enabled on the HAProxy cluster. SELinux once again likes to make life harder than it should be !
Further testing completed on the HAProxy HA pair.
Validated:
- ThinLinc native client access through the HAProxy VIP (SSH proxy).
- MFA authentication working through the HAProxy endpoint.
- New session creation.
- Session disconnect and reconnect.
- HAProxy node failure and VIP failover using Pacemaker.
Test scenario:
- Active ThinLinc native client session established through the HAProxy VIP.
- Active HAProxy node was shut down.
- Pacemaker moved the VIP to the remaining HAProxy node.
- Existing ThinLinc session remained available.
- After disconnecting, the native client successfully reconnected through the new HAProxy node.
So far the HAProxy gateway is behaving as expected and is providing a single HA endpoint for both ThinLinc web access and native client connectivity.
Next steps are HTTPS hardening (trusted certificates, TLS configuration, HSTS, cipher configuration) and further failure testing.