On Thu, 2014-06-12 at 10:35 -0400, Stephen Gallagher wrote:
> If you look at these two - they kind of mutually contradict a
bit.
> We want log forwarding to work, but we're explicitly requiring that
> any port likely to be used for it be firewalled?
>
It should probably read "the only incoming ports which may be open".
Log forwarding is an outgoing operation.
That's how it reads (more or less) in the second draft, but I was
considering the *server* system (see other mail about how this criterion
was written to require both client and server functions to work).
Also, this is only the default right-after-installation state. If
someone wants to use a machine as an rsyslog aggregation host, they're
going to need to do other configuration; asking them to call
firewall-cmd to open the external port is a reasonable request. It
shouldn't be open by default.
Sure - but I meant writing an 'exception' into the rsyslog criterion,
not the firewall one. I did it in the second draft, anyway, so see if
that makes sense to you.
--
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | XMPP: adamw AT happyassassin . net
http://www.happyassassin.net