jails, ipfilter & stunnel

[Uwe Doering]

V. Jones wrote:
>>Good point.  I forgot to mention that you should bind daemons running
>>outside the jails explicitly to the server's IP address.  This
>>circumvents the problem you've pointed out.  But I agree with you that
>>people would be less likely to shoot themselves in the foot if the
>>kernel took care of things in this situation.
> 
> Oh - okay.  The directions I followed in "Absolute BSD" had me configure
> all Daemons so that they only listened on the main ip address.  Is this
> what you guys are talking about it?  Actually, the book said the jailed
> server wouldn't even start if this wasn't done.
> 
> For example, in my /etc/ssh/sshd_config:
> 
> ListenAddress x.x.x.8

Yes, this is the way to do it.

    Uwe
-- 
Uwe Doering         |  EscapeBox - Managed On-Demand UNIX Servers
gemini at geminix.org  |  http://www.escapebox.net