Proxmox/pve-docs
5
0
Fork 0
mirror of git://git.proxmox.com/git/pve-docs.git synced 2025-08-02 16:21:55 +03:00
Code Releases Activity

pveproxy: avoid over use of notes

Browse Source 
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Thomas Lamprecht
2021-05-07 19:01:21 +02:00
parent e7084ef7d0
commit 8569bf94a3
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
pveproxy.adoc
View File

@ -66,12 +66,19 @@ Listening IP
By default the `pveproxy` and `spiceproxy` daemons listen on the wildcard
address and accept connections from both IPv4 and IPv6 clients.
By setting `LISTEN_IP` in `/etc/default/pveproxy` you can control to which IP
address the `pveproxy` and `spiceproxy` daemons bind. The IP-address needs to
be configured on the system.
This can be used to listen only to an internal interface and thus have less
exposure to the public internet:
Setting the `sysctl` `net.ipv6.bindv6only` to the non-default `1` will cause
the daemons to only accept connection from IPv6 clients, while usually also
causing lots of other issues. If you set this configuration we recommend to
either remove the `sysctl` setting, or set the `LISTEN_IP` to `0.0.0.0` (which
will only allow IPv4 clients).
`LISTEN_IP` can be used to only to restricting the socket to an internal
interface and thus have less exposure to the public internet, for example:
----
LISTEN_IP="192.0.2.1"
@ -106,11 +113,6 @@ long-running worker processes, for example a running console or shell from a
virtual guest. So, please use a maintenance window to bring this change in
effect.
NOTE: setting the `sysctl` `net.ipv6.bindv6only` to `1` will cause the daemons
to only accept connection from IPv6 clients. This non-default setting usually
also causes other issues. Either remove the `sysctl` setting, or set the
`LISTEN_IP` to `0.0.0.0` (which will only allow IPv4 clients).
SSL Cipher Suite
----------------