[
https://issues.apache.org/jira/browse/ZOOKEEPER-2221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14609914#comment-14609914
]
Hudson commented on ZOOKEEPER-2221:
-----------------------------------
SUCCESS: Integrated in ZooKeeper-trunk #2742 (See
[https://builds.apache.org/job/ZooKeeper-trunk/2742/])
ZOOKEEPER-2221: Zookeeper JettyAdminServer server should start on configured IP
(Surendra Singh Lilhore via rgs) (rgs:
http://svn.apache.org/viewcvs.cgi/?root=Apache-SVN&view=rev&rev=1688505)
* /zookeeper/trunk/CHANGES.txt
* /zookeeper/trunk/src/docs/src/documentation/content/xdocs/zookeeperAdmin.xml
*
/zookeeper/trunk/src/java/main/org/apache/zookeeper/server/admin/JettyAdminServer.java
> Zookeeper JettyAdminServer server should start on configured IP.
> ----------------------------------------------------------------
>
> Key: ZOOKEEPER-2221
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2221
> Project: ZooKeeper
> Issue Type: Bug
> Components: server
> Affects Versions: 3.5.0
> Reporter: Surendra Singh Lilhore
> Assignee: Surendra Singh Lilhore
> Fix For: 3.5.2, 3.6.0
>
> Attachments: ZOOKEEPER-2221.patch, ZOOKEEPER-2221.patch,
> ZOOKEEPER-2221.patch, ZOOKEEPER-2221.patch, ZOOKEEPER-2221_1.patch
>
>
> Currently JettyAdminServer starting on "0.0.0.0" IP. "0.0.0.0" means "all IP
> addresses on the local machine". So, if your webserver machine has two ip
> addresses, 192.168.1.1(private) and 10.1.2.1(public), and you allow a
> webserver daemon like apache to listen on 0.0.0.0, it will be reachable at
> both of those IPs.
> This is security issue. webserver should be accessible from only configured IP
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
