Re: Allowing localhost in access control files

[Ralph Lange via Tech-talk <tech-talk at aps.anl.gov>]

On Mon, 13 Jun 2022 at 15:27, Simon Rose via Tech-talk <tech-talk at aps.anl.gov> wrote:

 

Is it possible to set up an access security file to allow only CA/PVA requests from the same host as the IOC? One option of course is to use asSetSubstitutions and some variable, but it seems like there should be a more intrinsic way of doing this.

 

I have attempted using the name “localhost”, asCheckClientIP set to 1, even using 127.0.0.1 as a member of the host access group, but none of these seemed to work.

 

My two main questions:

• Is there a better or more canonical way of doing this?
• Perhaps more importantly--particularly if we have to use environment variables and substitutions--is there some danger or pitfall about this that we should be careful about?

Actually...

If the only aim is to restrict access to clients on the local machine (e.g. for test environments to not affect other hosts), I would bind the IOC's server to localhost and not use AS.

Cheers,
~Ralph