Some advice: only expose web server on a as-needed basis

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

diff --git a/pdns/recursordist/docs/http-api/index.rst b/pdns/recursordist/docs/http-api/index.rst
index ff18543f2ede9d49cbe5077a12efd2fd453a380e..a4ef51b5129cdbfcf6dc39a8f1937c00456d0313 100644 (file)
--- a/pdns/recursordist/docs/http-api/index.rst
+++ b/pdns/recursordist/docs/http-api/index.rst
@@ -21,9 +21,11 @@ Webserver
 
 To launch the internal webserver, set :ref:`setting-yaml-webservice.webserver` to ``true`` the configuration file.
 This will instruct PowerDNS to start a webserver on localhost at port 8081, without password protection.
-By default the webserver listens on localhost, meaning only local users (on the same host) will be able to access the webserver. Since the default ACL before 4.1.0 allows access from everywhere if :ref:`setting-yaml-webservice.address` is set to a different value, we strongly advise the use of a password protection.
+By default the webserver listens on localhost, meaning only local users (on the same host) will be able to access the webserver.
+
 The webserver lists a lot of potentially sensitive information about the PowerDNS process, including frequent queries, frequently failing queries, lists of remote hosts sending queries, hosts sending corrupt queries etc.
-The webserver does not allow remote management.
+The webserver does allow very limited remote management.
+
 The following webserver related configuration items are available:
 
 * :ref:`setting-yaml-webservice.webserver`: If set to ``yes`` a webserver is launched.
@@ -32,6 +34,11 @@ The following webserver related configuration items are available:
 * :ref:`setting-yaml-webservice.port`: Port to bind the webserver to.
 * :ref:`setting-yaml-webservice.allow_from`: Netmasks that are allowed to connect to the webserver
 
+.. warning::
+
+   To achieve defense-in-depth, expose the webserver only to clients addresses that need to access it.
+   Network access is configured by setting :ref:`setting-yaml-webservice.address` and :ref:`setting-yaml-webservice.allow_from`. Starting with version 5.3.0 :ref:`setting-yaml-webservice.listen` has been introduced, superseding :ref:`setting-yaml-webservice.address` if set.
+
 .. warning::
 
    Not setting a password will allow passwordless access to the frontpage showing statistics, the :doc:`endpoint-jsonstat`, the :doc:`../common/api/endpoint-statistics` and the ``localhost`` specific endpoint of the :doc:`../common/api/endpoint-servers`.