| Re: [chrony-dev] Multihomed (multiple) network interfaces support ! |
[ Thread Index |
Date Index
| More chrony.tuxfamily.org/chrony-dev Archives
]
- To: chrony-dev@xxxxxxxxxxxxxxxxxxxx
- Subject: Re: [chrony-dev] Multihomed (multiple) network interfaces support !
- From: Miroslav Lichvar <mlichvar@xxxxxxxxxx>
- Date: Tue, 5 Sep 2023 14:57:20 +0200
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1693918643; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=zy01PZkGMNMHfu2oKEZeNVoEZUwYjC0wwjbgNmbVG74=; b=JOb/SfNyA+at7hqqu7G6AnPRu5XzZIhhURROex1hGJgxk4qmFVDF2RK7ozmK4J6WCjDhMY iERvzQfX7lWLiMe0cRthIEBKsoRBkpED90UCd17ysv3mpKQtaGSwVoRH3YGM3RHhWd8+Yu onstQh/W8/FqqdywHr+ejlxqc8bXiRo=
On Tue, Sep 05, 2023 at 03:44:35PM +0300, CpServiceSPb wrote:
> Due to Weak ES mode in Linux OSes, please remake a test but change a little
> bit test conditions:
> When aiming for Strong ES Model in Linux, you'll first need these sysctl
> settings:
> net.ipv4.conf.all.arp_filter=1
> net.ipv4.conf.all.arp_ignore=1 # or even 2
> net.ipv4.conf.all.arp_announce=2
It makes no difference. These settings are about ARP (L2->L3
translation) and multiple interfaces in the same network.
> *And I see the only way is to implement not bindaddress but binddevice
> available multiple times for listening and receiving requests to.*
That would make more sense for security. However, it's not a simple thing
to implement as peer associations use the server sockets too, so there
would need to be some code selecting the right socket.
My recommendation is to run multiple instances of chronyd, each bound
to a different interface.
--
Miroslav Lichvar
--
To unsubscribe email chrony-dev-request@xxxxxxxxxxxxxxxxxxxx with "unsubscribe" in the subject.
For help email chrony-dev-request@xxxxxxxxxxxxxxxxxxxx with "help" in the subject.
Trouble? Email listmaster@xxxxxxxxxxxxxxxxxxxx.