Re: cfengine, firewall and security

[Mark R. Lindsey]

: has anybody ever tried to use cfengine through a firewall without
: compromising security ? I mean, keep the reference server protected
: behind a firewall, and synchronize clients located both inside and
: outside the firewall.

I have one cfengine server setup with firewall filtering; the protocol
is straightforward enough -- connections from any TCP port on the client
are made to port 5308 TCP on the cfd server, and no TCP connections are
made from the cfengine server back to the client.

Just setup specific rules on the firewall to allow each external client
to connect to 5308 TCP on the internal cfengine server.