Hi gurus,
This is a question from a customer, he has security concern on seting sshd AllowTcpForwarding to Yes.
Dos that mean vbr will issue commands from "initial node" to backup hosts through other vertica nodes?
Regards,
DQ
Question
Why vbr need sshd AllowTcpForwarding = Yes ?
+1
DQ, haven't seen you post in a while. Nice to hear from you. I wonder if you would want to ask the VBR team this question. They have their own address. I probably shouldn't post it here. I'll send it via e-mail.
+1Thanks Tom, expecting your email.
+1Answer from engineer:
AllowTcpForwarding is required by XML-RPC protocol, which is used by vbr to coordinate workers on each Vertica nodes. We use ephemeral ports, but only on the loopback address.
So if cusomter have concerns about setting AllowTcpForwarding, then can apply it selectively by user/group and IP address with Match blocks. eg:
AllowTcpForwarding no
Match User dbadmin Address 192.168.100.101, 192.168.100.102, 192.168.100.103, 192.168.100.104
AllowTcpForwarding yes
Nice job, DQ. Thanks for sharing.
Sign up
Already have an account? Login
Welcome to the Rocket Forum!
Please log in or register:
Employee Login | Registration Member Login | RegistrationEnter your E-mail address. We'll send you an e-mail with instructions to reset your password.
77 4th Avenue
Waltham, MA 02451 USA
