<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div style="RIGHT: auto"><SPAN style="RIGHT: auto">Hey Spacewalk user, I am also very new to space walk. </SPAN></div> <div style="RIGHT: auto"><SPAN style="RIGHT: auto"></SPAN> </div> <div style="RIGHT: auto"><SPAN style="RIGHT: auto">1. I'm still trying to figure out how to install a bare metal workstation. I think the following message is saying to add the new ip of the workstation the the server kickstart file but not sure.</SPAN></div> <div style="RIGHT: auto"><SPAN style="RIGHT: auto"></SPAN> </div> <div style="RIGHT: auto">The following IP Address ranges are associated with kickstart profiles. </div> <div style="RIGHT: auto">New systems can be kickstarted based upon their ip address by appending <CODE style="RIGHT: auto">ks=http://xxxx.xxx.xxx.com/ks/cfg/org/1/mode/ip_range</CODE> to the kernel parameters for a kickstart install. </div> <div style="RIGHT: auto"> <FORM style="RIGHT: auto" id=listset_405272723 method=post name=name_405272723 action=/rhn/kickstart/KickstartIpRanges.do><INPUT style="RIGHT: auto" type=hidden name=csrf_token> <INPUT value=true type=hidden name=submitted> <INPUT value=true type=hidden name=list_2723518404_search_parent><INPUT value=false type=hidden name=list_2723518404_search_child><INPUT value=true type=hidden name=list_2723518404_parent_is_an_element> </div> <DIV class=filter-input> <TABLE cellSpacing=0 cellPadding=0 width="100%"> <TBODY> <TR> <TD class=list-infotext vAlign=center></TD></TR></TBODY></TABLE><BR></DIV></FORM> <DIV style="FONT-FAMILY: times new roman, new york, times, serif; FONT-SIZE: 12pt"> <DIV style="FONT-FAMILY: times new roman, new york, times, serif; FONT-SIZE: 12pt"> <DIV dir=ltr><FONT size=2 face=Arial> <DIV style="BORDER-BOTTOM: #ccc 1px solid; BORDER-LEFT: #ccc 1px solid; PADDING-BOTTOM: 0px; LINE-HEIGHT: 0; MARGIN: 5px 0px; PADDING-LEFT: 0px; PADDING-RIGHT: 0px; HEIGHT: 0px; FONT-SIZE: 0px; BORDER-TOP: #ccc 1px solid; BORDER-RIGHT: #ccc 1px solid; PADDING-TOP: 0px" class=hr contentEditable=false readonly="true"></DIV><B><SPAN style="FONT-WEIGHT: bold">From:</SPAN></B> Scott Worthington <scott.c.worthington@gmail.com><BR><B><SPAN style="FONT-WEIGHT: bold">To:</SPAN></B> spacewalk-list@redhat.com <BR><B><SPAN style="FONT-WEIGHT: bold">Sent:</SPAN></B> Thursday, June 7, 2012 9:33 AM<BR><B><SPAN style="FONT-WEIGHT: bold">Subject:</SPAN></B> Re: [Spacewalk-list] Limiting access to spacewalk webinterface<BR></FONT></DIV><BR>On 6/7/2012 11:18 AM, Jeremy Maes wrote:<BR>> Hey Spacewalk users<BR>> <BR>> I'm new to the list but have been testing Spacewalk since version 1.3. Recently made a clean installation of 1.7 to start using in production, but I have a question about the webinterface.<BR>> <BR>> First a little overview of out current situation:<BR>> I have Spacewalk 1.7 installed on PostgreSQL, on a CentOS 6.2 server. The Spacewalk server itself is in our DMZ because it needs to be accessible by our other servers at over 200 remote sites.<BR>> Now I would very much like to close off the access to the webinterface for the outside world, and only make it available for access from our internal IP's.<BR>> <BR>> I know this is something that is probably possible through customizing the apache config, but there's 2 things holding me back from trying it out as of yet:<BR>> <BR>> * I'm not really sure which of the config files to change, and where I'd have to put the change(s).<BR>> * Will my remote servers still be able to send and receive updates, register if needed, etc... if I shut down the webinterface for external hosts? It is my perception that almost all communication runs over http(s) through webservices hosted by apache and I'm afraid of closing those off too. Is it possible to selectively shut off access to only the webUI but not the rest?<BR>> <BR>> Any pointers or tips would be really appreciated!<BR>> <BR>> Regards,<BR>> Jeremy<BR><BR>Have you considered using iptables on the Spacwalk server to limit ports 80 and 443 (and other ports for Spacewalk) to your internal IP addresses?<BR><BR>Or perhaps just limit all initial inbound communication to your Spacewalk server to your internal IP addresses in iptables.<BR><BR>_______________________________________________<BR>Spacewalk-list mailing list<BR><A href="mailto:Spacewalk-list@redhat.com" ymailto="mailto:Spacewalk-list@redhat.com">Spacewalk-list@redhat.com</A><BR><A href="https://www.redhat.com/mailman/listinfo/spacewalk-list" target=_blank>https://www.redhat.com/mailman/listinfo/spacewalk-list</A><BR><BR><BR></DIV></DIV></div></body></html>