Arm_Security.config; Format; Example - HP P4535A - Web Cache Server Appliance Administrator's Manual

Appendix D

arm_security.config

The
arm_security.config
allow, and deny lines that specify the hosts that are allowed to communicate with the Traffic Server ARM
using TCP and UDP through defined ports. Traffic Server uses this configuration file when the ARM security
option is enabled. For information about enabling the ARM security option, refer to
to the Traffic Server machine (ARM security)‚ on page
By default, the
arm_security.config
Traffic Server, are closed unless explicitly opened. This means that when using this configuration file, you
must open the ports that are being used by Traffic Server, among others. Otherwise remote origin servers will
be unable to communicate with the proxy.
Lines within the
arm_security.config
Define the ports that are to be open by default, for either TCP and UDP
Define the hosts that are to be denied access to specific destination ports, for either TCP and UDP
Define the hosts that are to be allowed access to specific destination ports, for either TCP or UDP
CAUTION

Format

Each line in the
arm_security.config
open tcp | udp ports o_ports
deny tcp | udp dport d_ports src src_IPaddresses
allow tcp | udp src src_IPaddresses dst dst_IPaddresses dport d_ports sport s_ports
The following table describes each field:
Field
o_ports
d_ports
s_ports
src_IPaddresses
dst_IPaddresses

Example

The following example defines ports 80, 119, 23, and 554 as open for TCP communication. All other ports are
closed:
open tcp ports 80 119 23 554
file contains the ARM access control list. The file consists of a series of open,
file adopts a strategy whereby all ports except for 8080, used by
generally assume the following functional order:
Before you enable the ARM security option, ensure that you have either console access
to the Traffic Server machine or that you have added the appropriate rules to the
configuration file to allow telnet or ssh access for yourself.
file uses one of the following formats
Allowed inputs
The port, or series of ports separated by spaces, to open by default.
The destination port, or series of destination ports separated by spaces, through
which TCP traffic should either be allowed or denied.
The source port, or series of source ports separated by spaces, from which TCP
traffic should be allowed.
The IP address, or range of IP addresses, specifying the source of the
communication.
The IP address, or range of IP addresses, specifying the destination of the
communication.
81.
Configuration Files
Controlling host access
160