Active Probing Protection about ssh3

[francoismichel]

That's a great set of features indeed.

Not sure what you mean by that:

If the user enters the wrong secret path, they connect to the Ngnix web server (fallback).

Maybe one way to achieve all these features would just be to be integrable with existing web servers such as caddy, nginx, etc, and let them do that work.

[FPPweb3]

Not sure what you mean by that:

If the user enters the wrong secret path, they connect to the Ngnix web server (fallback).

Fallback refers to the following mechanism:
https://github.com/klzgrad/naiveproxy

The project's GitHub home page provides a sample implementation with a custom web page.
Below is an example of how to proxy someone else's website:

### /etc/caddy/Caddyfile

{
  order forward_proxy before file_server
}
:443, SERV_DOMAIN {
  tls ADMIN_EMAIL
  forward_proxy {
    basic_auth USR_NAME USR_PASS
    hide_ip
    hide_via
    probe_resistance
  }
  reverse_proxy PROXY_SITE {
    header_up Host {upstream_hostport}
  }
}

I suggested using the Ngnix web server because of the lower resource consumption (my guess).

A more detailed description of the FallBack mechanism can be found at the following links:
https://xtls.github.io/en/document/level-1/fallbacks-with-sni.html
https://xtls.github.io/en/config/features/fallback.html#fallbacks-configuration

Similarly, the following mechanism is used in ocserv in camouflage mode:
https://ocserv.gitlab.io/www/manual.html#:~:text=%23%20The%20following%20options%20are%20related,example.com/%3Fmysecretkey%22.%0Acamouflage_secret%20%3D%20%22mysecretkey%22