5

Say I want to deploy a software that acts as a server and I want to avoid scenarios where interfaces are replaced, IP addresses are changed, etc.

The nature of the environment in which this software is deployed on is a bit dynamic, the computer may be taken to different networks.

I decide then to deploy it configuring the address 0.0.0.0 to bind to the service configured port and job done.

Will network administrators frown upon it? (I got the impression they would). If yes, why?

Hope this is not an opinion based question and there are facts to support answers.

  • I don;t think there is an objective answer to the question, but I would not have any issue with it, provided that I had the option to bind to a specific interface if there were reason for me to do so. In the situation you describe, a less explicit binding is definitely in order. – Frank Thomas Dec 15 '15 at 16:52
  • 1
    Give the network administrators the option on what IP to bind it on. – barlop Dec 15 '15 at 17:02
5

I decide then to deploy it configuring the address 0.0.0.0 to bind to the service configured port and job done.

Will network administrators frown upon it?

It would be bad practice if it's not necessary.

For some networks it may be necessary. And you won't know. It's not your decision to make.

Give the network administrators the option on what IP to bind it on.

Added note to clarify

It's not for you to make the decision of what IP to bind onto and not give the network admin the option to change it (which is what it sounds like you're talking about). It's fine for you to offer a default.

| improve this answer | |
  • 1
    can't say I agree. many core linux services bind to 0.0.0.0 by default, and it is absolutely, 100% the developer/packager's job to ensure that a valid and widely-accepted default is provided for all configuation settings, until such time as an admin chooses to override it (eg its not only the dev's decision to make, its their responsibility to make it). – Frank Thomas Dec 15 '15 at 17:16
  • @FrankThomas it's the dev's responsibility to decide on a default(it's impossible for it to be anybody elses), but it's not the dev's responsibility to decide without giving the network admin the option. – barlop Dec 15 '15 at 17:25
  • @barlop Why would it be a bad practice if not necessary? Is it just based on the fact that one would allocate the port on all interfaces and not make it available for other potential services? I'd assume that having different services in same ports for different interfaces would possible lead to confusion (at least for me) later on for diagnosing problems. – johnildergleidisson Dec 15 '15 at 18:12
  • @JoaoMilasch A reason for binding a server to the LAN even when there is a firewall that can restrict connections Is If the firewall wasn't doing the job of restricting access to the server, then those that shouldn't, could connect. So it's a second line of defense. – barlop Dec 15 '15 at 19:01
  • @JoaoMilasch and it's not to enable them to run different/more servers on the same port number but different interfaces, purely to save ports. There are so many port numbers 65535, that such a stunt would not be necessary and would be confusing to many and would no doubt thus be considered bad practice. If a system had lots of network cards and each was expected to be running a different server then running those different servers probably wouldn't be bad practice - it wouldn't be confusing if it was expected or documented.Though it might be a mad practice, if there's no reason for it!. – barlop Dec 16 '15 at 10:50
1

That depends on what interfaces are available on the machine. If you only have one active interface at a time that is reachable from outside, it makes no difference.

If you have more active interfaces e.g. in the subnets 10.0.0.0/24 and 10.0.1.0/24 and you want only people from the 10.0.0.0/24 subnet to be able to connect, you have to either restart your service every time you get a new ip or bind to 0.0.0.0 and block traffic using a firewall.

One could argue that in the second case if you bind to 0.0.0.0 you introduce an extra point of possible failure(the firewall), but I would say the risk is negligible.

| improve this answer | |
  • I appreciate the answer although I understand the technicality. The discussion I'm raising is as to why it would be a bad practice, generally? – johnildergleidisson Dec 15 '15 at 18:22
  • Oh, I understood it wrong, sorry. I agree to Frank Thomas and barlop on that matter. – tastytea Dec 15 '15 at 19:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.