On Mon, May 27, 2013 at 11:05:43AM +0200, Ivan Vilata i Balaguer wrote: > > The server needs the HUP so it will reread the host config files and > > update its list of approved Subnets. However, the validity of a Subnet > > that a node announces is only checked when that node announces its > > Subnet. So the best way is to make sure the server gets the new host > > config file and a HUP signal before the new node comes online. > > Thanks for the explanation, Guus. What I didn't mention (and is indeed > the reason for my surprise) is that in another setup using nearly the > same software environment, we checked that tinc doesn't need the HUP to > accept new nodes! The main difference is that the first one is an LXC > container and the second one a physical host. Go figure. Anyway I > guess it's better to play safe and send the HUP.
Well, maybe my explanation was not complete: tinc does not need HUP to accept
new nodes, it only needs HUP to reread the list of approved Subnets when
StrictSubnets is enabled.
> > There are various options that control forwarding of information. You
> > might want to use the TunnelServer option in your case.
>
> In our setup we want some core nodes to have the host files of all nodes
> in the tinc network and connect among themselves, and other "peripheral"
> nodes to only have the file of the core node they ConnectTo, but still
> be able to exchange data directly with other nodes if the underlying
> network allows it. Thus we do want to forward all the information in
> core nodes, but only if it matches what the known host file states. In
> other words, whenever the node would print "Ignoring unauthorized
> ADD_SUBNET from X" it would not forward the info for node X, so core
> nodes would act like some kind of authenticators. But well, with the
> warning we're at least able to spot rogue nodes. ;)
Ok, in that case StrictSubnets is exactly what you want.
--
Met vriendelijke groet / with kind regards,
Guus Sliepen <[email protected]>
signature.asc
Description: Digital signature
_______________________________________________ tinc mailing list [email protected] http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
