Hi all,
Richard Sims wrote:
Remco -
Perhaps you could elaborate on how this would be useful? Having the
server ignore requests which come into the system via a certain path
doesn't seem productive.
It is, actually, from a security perspective. This way, one could
dedicate an instance to a subnet and be very sure it is impossible to
reach from other subnets.
One other use would be to have each instance listen on port 1500 of a
dedicated IP address (rather than a dedicated port on a shared IP
address), though I currently don't envision using TSM that way.
Anyway, what you envision seems better effected via a firewall
implemented at the environmental level (in the OS, or a router)
rather than in an application (TSM).
Host based firewalls could accomplish the same but:
1- add additional load to the host, unneeded since this could very
easily be programmed in the server
2- add additional cost in system administration
3- on AIX the is neither a built-in firewall, nor do any of the freeware
firewalls support AIX.
4- this is very easily implemented in the systemcalls required to set up
a TCP server anyway.
The network firewall is ineffective against hosts on the same subnet.
Not that I distrust these, but auditors might...
The reason I'd like to see this implemented in TSM is that the
application seems to be the proper place to configure the application. A
great many applications (webserver, ftp servers, dns servers etc.) all
provide this feature.
Richard Sims
On Apr 27, 2005, at 5:17 AM, Remco Post wrote:
Hi All,
We are running TSM v. 5.2.3 on AIX 5.2. Currently all of our TSM
server instances listen on all IP addresses configured in the OS. I
was wondering if anyone has found a way to make the TSM server not
listen for connections on one or more ip-addresses. I'm sure this
would be very usefull in my environment.
--
Met vriendelijke groeten,
Remco Post
SARA - Reken- en Netwerkdiensten http://www.sara.nl
High Performance Computing Tel. +31 20 592 3000 Fax. +31 20 668 3167
"I really didn't foresee the Internet. But then, neither did the
computer industry. Not that that tells us very much of course - the
computer industry didn't even foresee that the century was going to
end." -- Douglas Adams
| 