From owner-freebsd-hackers@FreeBSD.ORG Thu Jun 4 14:27:32 2009 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 8FD37106564A for ; Thu, 4 Jun 2009 14:27:32 +0000 (UTC) (envelope-from erdgeist@erdgeist.org) Received: from elektropost.org (elektropost.org [217.13.206.130]) by mx1.freebsd.org (Postfix) with ESMTP id CC8178FC15 for ; Thu, 4 Jun 2009 14:27:31 +0000 (UTC) (envelope-from erdgeist@erdgeist.org) Received: (qmail 85954 invoked from network); 4 Jun 2009 14:00:49 -0000 Received: from unknown (HELO bauklotz.local) (erdgeist@erdgeist.org@62.220.7.20) by elektropost.org with AES256-SHA encrypted SMTP; 4 Jun 2009 14:00:49 -0000 Message-ID: <4A27D38B.6040108@erdgeist.org> Date: Thu, 04 Jun 2009 16:00:43 +0200 From: Dirk Engling User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: freebsd-hackers@freebsd.org X-Enigmail-Version: 0.95.7 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Jails, loopback interfaces and sendmail X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Jun 2009 14:27:32 -0000 Dear fellow hackers, since jail can be bound on multiple IP addresses I tend to clone multiple loopback interfaces and add one loopback address to each jail cloned_interfaces="lo1 lo2 lo3" ifconfig_lo1_alias0="inet 127.0.0.2 netmask 0xffffffff" ifconfig_lo2_alias0="inet 127.0.0.3 netmask 0xffffffff" ifconfig_lo3_alias0="inet 127.0.0.4 netmask 0xffffffff" .. no this is not yet optimal, since I can not run several jails on a single external IP anymore, but at least local daemons are not visible to the outside world, anymore. However, grep -R 127.0.0.1 /etc reveals, that sendmail in many places assumes localhost to be on 127.0.0.1 instead of looking it up in /etc/hosts or using 127.0.0.0/8 to identify a local connection. I worry that more programmers made those assumptions, possibly breaking more tools. My question is: Who's the right guy to beg to fix sendmail or alternatively would it be smart to allow each jail to have its own concept of 127.0.0.1 on a dummy interface mapped to all jails, that itself doesn't count as a bound IP address (thus allowing the jail to bind to an already bound ip address) and is not routed between jails? Any ideas? erdgeist