-
fgudinhi, a quick one, as i can’t find anything useful online or in the manual
-
fgudincan the GZ be firewalled ? i’ve got to expose the admin nic to internet, and i’d like to restrict it to basically 2 IP addr
-
jbkit should.. what I can't recall offhand is if the management bits will manage rules for the admin nic or just the VMs
-
jbkif not, you'd just have to use ipfilter directly (and probably setup a bit to apply the rules at boot)
-
fgudinyes, fwadm mentions zones without being explicit wrt global or not; i assume it doesn’t handle it
-
fgudinhowever, i’ll look at ipfilter, thanks!
-
fgudinbtw, another topic: weeks ago i asked about a poor-man’ solution to have disks encrypted, somehow
-
fgudini planned to write something about it, but i didn’t get around to it, so here’s a short feedback:
-
fgudinlong story short, i resorted to use a ’clear’ boot pool and have ’zones’ encrypted
-
fgudinthe trick was to edit /lib/svc/method/fs-joyent so:
-
fgudin--- fs-joyent.orig Sun Jun 14 18:44:48 2026
-
fgudin+++ fs-joyent Sun Jun 14 18:48:15 2026
-
fgudin@@ -121,7 +121,7 @@
-
fgudinis_encr="$(zfs get -Hpo value encryption $pool)"
-
fgudin- [[ "$is_encr" != "off" ]] && unlock_pool $pool
-
fgudin+ [[ "$is_encr" != "off" ]] && zfs load-key -a
-
fgudinsorry, here it is: okturing.com/src/20694/body
-
fgudinthe tricky part of the story is the editing of platform/i86pc/amd64/boot_archive with xxd
-
fgudinplus the convoluted way to run the installer
-
danmcdHello. Tonight's SmartOS release will fix these:
-
danmcdfenix illumos#18003
-
fenixBUG 18003: 18003 poll(4D) needs to better-check numfds (CVE-2026-35384) (Closed)
-
fenix
-
danmcdfenix illumos#18020
-
fenixBUG 18020: Double copyin of dld_ioc consumers (Closed)
-
fenix
-
danmcdfenix illumos#18117
-
fenixBUG 18117: SCTP needs to better-check INIT ACK chunk parameters (Closed)
-
fenix
-
danmcdThere are mitigations and defenses for all, but updating is the best solution.