Unpredictable rsync source address on dual-stack or multiple interface servers #8
Comments
mpounsett
added a commit
to mpounsett/sie-dns-sensor
that referenced
this issue
May 5, 2023
- adds an optional config parameter `rsync_source`, which will set the bind_interface option on the ssh session used by rsync when present
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Farsight sets ACLs to only allow rsync of SIE data from specific sources. However, on systems with multiple interfaces it is unpredictable which source address will be used to upload data, which can run afoul of those ACLs.
The official advice we got when setting up the sensor was to directly modify the
ssh_cmddefinition in/usr/lib/sie/functionsto pin a source address. However, this hidden change can break as servers are updated or replaced, as we recently discovered on a server that hadn't successfully uploaded any data for two years.The config file should accept an optional source address for rsync, and use that (if present) to set the source address on the
ssh_cmd.The text was updated successfully, but these errors were encountered: