Re: Listening on specific interfaces

[Paul Heinlein]

On Mon, 25 Aug 2003 Mark.Burgess@iu.hio.no wrote:

> 0.0.0.0 is not a specific interface but a wildcard IP address. It
> means "allow connections from any client". If you bind to a specific
> IP then you might restrict to traffic from a single host, but is
> that very useful?

Sure:

1. If a client is multi-homed, the policy host currently has to have
   root-${if-1}.pub and a symlink pointing to it for each additional
   interface. This is a hack we've already had to implement for a
   couple hosts.

2. Likewise, the policy host could have multiple interfaces, but the
   clients could always count on
   /var/cfengine/ppkeys/root-${ipaddr}.pub, without having to resort
   to having symlinks to the policy host's public key for each of the
   policy host's ${ipaddr}. Our policy host is single-homed, so this
   isn't something we've had to implement.

3. If a client host has one leg on a trusted network and one leg on a
   public network, it'd be helpful to bind cfengine only to the
   trusted interface.

-- Paul Heinlein <heinlein@cse.ogi.edu>