> It is a waste. But it does serve a useful purpose: Each instance is
> *completely* partitioned from the other. (They'll be running under a
> jail(), as well as being denied access to most everything by kernel ACLs
> in the host system.
Okay, gotcha :-)
> The idea is described badly at http://www.projectgibson.org. The idea is
> ultimate security; isolating ethernets is what I'll call a third-level
> defense, that is, if someone manages to compromise whatever's protecting
> the outside interface (theoretically impossible, I think, but why take
> chances), they still can't launch an attack on the internal network.
This is how my network is setup at home - Lots of bridges and tap
devices connected to individual ethX devices on the host.
> This part I'm not sure I grok, but I'll play with it a bit and see if I
> can make sense of it. Thanks for your help, and your work on uml that
> makes that help possible.
If you want all the UMLs to communicate, you'll either have to set
something up to route between them, or setup eth1 devices on the UMLs
using any of the transports, allowing them to connect to each other.
David Coulson http://davidcoulson.net/