FireBrick FB6602, Руководство пользователя

Страница: 71 / 152

System Services
56
log
The standard
log
,
log-error
, and
log-debug
settings can be used to
specified levels of logging for the service.
a
A locally-attached subnet is one which can be directly reached via one of the defined interfaces, i.e. is not accessed via a gateway.
Tip
Address ranges in
allow
can be entered using either <first address>-<last_address> syntax, or
using CIDR notation : <start address>/<prefix length>. If a range entered using the first syntax
can be expressed using CIDR notation, it will be automatically converted to that format when the
configuration is saved. You can also use name(s) of defined IP address group(s) - see Section 3.1 for
discussion of address groups.
12.2. HTTP Server configuration
The HTTP server's purpose is to serve the HTML and supporting files that implement the web-based user-
interface for the FB6000. It is not a general-purpose web server that can be used to serve user documents, and
so there is little to configure.
12.2.1. Access control
By default, the FB6000 will allow access to the user interface from any machine, although obviously access to
the user interface normally requires the correct login credentials to be provided. However, if you have no need
for your FB6000 to be accessed from arbitrary machines, then you may wish to 'lock-down' access to the user
interface to one or more client machines, thus removing an 'attack vector'.
Access can be restricted using
allow
and
local-only
controls as with any service. If this allows access,
then a user can try and login. However, access can also be restricted on a per user basis to IP addresses and
using profiles, which block the login even if the passord is correct.
Additionally, access to the HTTP server can be completely restricted (to all clients) under the control of a
profile. This can be used, for example, to allow access only during certain time periods.
12.2.1.1. Trusted addresses
Trusted addresses are those from which additional access to certain functions is available. They are specified
by setting the
trusted attribute using address ranges or IP address group names. This trusted access allows
visibility of graphs without the need for a password, and is mandatory for packet dump access.
12.3. Telnet Server configuration
The Telnet server allows standard telnet-protocol clients (available for most client platforms) to connect to
the FB6000 and access a command-line interface (CLI). The CLI is documented in Chapter 17 and in the
Appendix G.
12.3.1. Access control
Access control can be restricted in the same way as the HTTP (web) service, including per user access
restrictions.
Note
By default, the FB6000 will only allow telnet access from machines that are on one of the locally-
attached Ethernet subnets
a
. This default is used since the CLI offers a degree of system control that
is not available via the web interface - for example, software images stored in the on-board Flash
memory can be deleted via the CLI.