Silicon Graphics Gauntlet, Руководство администратора

Страница: 92 / 306

66
Chapter 9: Managing MediaBase Services
Used together, these access controls and log files give you much more control over the
MediaBase connections to and from your system than you would have without the
firewall.
How It Works
The firewall runs the MediaBase proxy (mbase-gw) as a daemon listening for requests on
a series of ports: ports 6301, 6309, 6310, 6312, and 6313 handle control information; ports
6320 through 6323 and 6340 handle data information. When the firewall receives requests
for those ports, the MediaBase proxy checks its configuration information (in the
netperm-table file) and determines whether the initiating client has permission to use
MediaBase. If the client has permission, the proxy logs the transaction and passes the
request to the appropriate host.
The mbase-gw daemon is always active. This daemon requires that MediaBase players
also be configured to use a proxy.
The default policy allows clients inside the network to connect to MediaBase servers; it
does not allow outside clients such access, however. Because the firewall runs the
MediaBase proxy on all MediaBase ports, all requests from outside clients access the
MediaBase proxy rather than the server. This configuration prohibits running a
MediaBase server on the firewall itself—there is no way to start a MediaBase server to
accept such requests.
Configuring the Firewall to Use the MediaBase Proxy
Configuring the Gauntlet firewall involves planning, indicating which servers may be
accessed, and configuring the MediaBase proxy to enforce your policy.
Planning
Determine which internal users and hosts can use MediaBase, and determine whether
you want to run the MediaBase proxy.