On Mon, Sep 21, 2015 at 10:34:17PM +0000, Thrawn wrote: > > Does this mean that the TCP port is dangerous, or that the multiple > > instances of the socket is dangerous?? > > What is the danger with it? > > I believe the danger is that it may be externally visible, allowing outsiders > to start and stop your servers, add new backends and redirect traffic to > them, etc... > > It should be safe enough if the socket only listens on the loopback address, > but in that case, you may as well use Unix sockets. Otherwise, make sure that > you have strong authentication on the socket, a good firewall, and a trusted > network - and ask yourself whether you really need it. > > In some cases, it may be feasible to listen on the loopback address and > access it via an SSH tunnel.
Yes, that's *exactly* the idea. You can even use haproxy as a SSL frontend and filter to forward the connection. But SSH is quite secure and handy here. Willy
