From owner-freebsd-questions@FreeBSD.ORG Sun May 23 15:31:01 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C439316A4CE for ; Sun, 23 May 2004 15:31:01 -0700 (PDT) Received: from sage.thought.org (dsl231-043-140.sea1.dsl.speakeasy.net [216.231.43.140]) by mx1.FreeBSD.org (Postfix) with ESMTP id D52BB43D1D for ; Sun, 23 May 2004 15:31:00 -0700 (PDT) (envelope-from kline@tao.thought.org) Received: from thought.org (tao [10.0.0.247]) by sage.thought.org (8.12.8p2/8.12.8) with ESMTP id i4NMUb1F013903; Sun, 23 May 2004 15:30:39 -0700 (PDT) (envelope-from kline@tao.thought.org) Received: from tao.thought.org (localhost [127.0.0.1]) by thought.org (8.12.9p2/8.11.3) with ESMTP id i4NMUZfI064027; Sun, 23 May 2004 15:30:36 -0700 (PDT) (envelope-from kline@tao.thought.org) Received: (from kline@localhost) by tao.thought.org (8.12.9p2/8.12.11/Submit) id i4NMUXoh064026; Sun, 23 May 2004 15:30:33 -0700 (PDT) (envelope-from kline) Date: Sun, 23 May 2004 15:30:33 -0700 From: Gary Kline To: Rob Message-ID: <20040523223033.GA63339@tao.thought.org> References: <20040523192644.GA46148@tao.thought.org> <40B11902.8070801@users.sourceforge.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <40B11902.8070801@users.sourceforge.net> X-Organization: Thought Unlimited. Public service Unix since 1986. X-Of_Interest: Observing 17 years of service to the Unix community User-Agent: Mutt/1.5.6i cc: Gary Kline cc: freebsd-questions@freebsd.org Subject: Re: dhcp "dhcpd_ifaces" question. X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 May 2004 22:31:01 -0000 On Mon, May 24, 2004 at 06:34:58AM +0900, Rob wrote: > Gary Kline wrote: > > To any network wizards on-list, > > > > I'm just tidying up dhcp and namedb files and would like > > to know what strings to put after this: > > > > dhcpd_ifaces= # ethernet interface(s) > > > > I'm assuming it should be "dc0 dc1" but would like to make > > sure. If it would be just as well to leave it blank and > > let dhcpd figure it out, please advise. (In my old config > > file $IFACES wasn't defined.) > > I have dhcpd configured; I'm not using named, so I don't know about that. The reason I broughtup named is that whenever I tried to "start|restart" dhcp there were a slew of errs from named[`pid`] that showed named failing. By itself, starting or restarting named was *fine*. This is obviously one of those csmic mysteries... > > As far as I know, you can use dhcpd_ifaces to limit the DHCP service to only > one interface (provided you have more than one interface on your system). > > I have rl0 and rl1, where rl0 is on the out-side internet, and rl1 on the > internal network (with IP 10.0.0.1). I only want DHCP server for internal > network: I therefore have in /etc/rc.conf: > > dhcpd_ifaces="rl1" > > However, when you look at netstat output, dhcpd is still listening to all > interfaces, which may have some security risks. To further limit this, you > probably need a extra global line in /usr/local/etc/dhcpd.conf : > > local-address 10.0.0.1; > > Then you get a netstat output like this: > > udp4 0 0 10.0.0.1.bootps *.* > I understandmost of wshat you're saying. I have the same 10.0.0.N private net as you so I can (thankfully:) just cut&paste. Can you tell me what might happen in I added "dc0" to my dhcp_interfaces?? I have no clue how this could pose a security risks but I'm more than ready to take your word for it. --There really are a few sleazeballs out there.-- thank you much, gary -- Gary Kline kline@thought.org www.thought.org Public service Unix