About this list Date view Thread view Subject view Author view Attachment view

From: Herbert Poetzl (herbert_at_13thfloor.at)
Date: Tue 21 Sep 2004 - 11:01:15 BST


On Mon, Sep 20, 2004 at 11:44:26PM +0200, Gilles wrote:
> Hello.
>
> (1)
> To what should "IPROOT" be set to be able to set up the equivalent
> of the following, in a (single) vserver:
>
> serverApp1 listens to the "external" interface (e.g 192.168.12.10)
> serverApp2 listens to the "localhost" interface (127.0.0.1)
>
> The purpose is for "serverApp1" to serve as a proxy to "serverApp2"
> which shouldn't be reachable from the "outside".

'localhost' i.e. 127.0.0.1 is automagically rewritten
to the 'primary' assinged ip, which will probably cause
some issues if you rely on 127.0.0.1

> Or should I preferrably set up 2 different vservers, one for each
> serverApp<x> ?

if possible, that would be a better choice, IMHO

> (2)
> Is it possible to set up the equivalent of a LAN with a DMZ and
> a "secure" part, all within a single physical machine (with a
> single network adapter)?

yes, it is possible, but it does only make limited
sense if you are concerned about security ...

> Is it explained somewhere, or, if it doesn't make sense, please
> let me know why.

normally you setup a DMZ to create an environment
which allows to be less restrictive but still 'safe'
and exactly this isn't possible if you share the
same network card and/or the same host ...

sorted by increasing security IMHO:

 - single host, firewall, services, enduser, 1nic
 - single host, firewall, vservers (services), 1nic
 - single host, firewall, vservers (services, enduser), 2nic
 - separate firewall, 2nic (services), 2nd-host enduser
 - separate firewall, 2nic, 2nd-host (services), enduser
 - separate firewall, 2nic, 2nd-host vservers (services), enduser

best,
Herbert

> Thanks and best regards,
> Gilles
> _______________________________________________
> Vserver mailing list
> Vserver_at_list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Tue 21 Sep 2004 - 11:01:27 BST by hypermail 2.1.3