the config-file /etc/munin/munin-node.conf that's installed from upstream has one line 'host *' and the following commented out part again (at end of file): # uncomment this to only listen on the loopback/localhost interface # # host 127.0.0.1 if you just uncomment this last line in order to bind to loopback-interface, it's ignored when starting the daemon, because of the first line. a user may overlook this and end up in a more insecure configuration than intended. Reproducible: Always Steps to Reproduce: 1. emerge munin 2. comment out the 'host 127.0.0.1'-line (last one) in /etc/munin/munin-node.conf and forget about the 'host *' 3. /etc/init.d/munin-node start Actual Results: munin-node binds on all interfaces Expected Results: munin-node binds to loopback interface in my opinion it's not a real bug, but what the comment says is not correct or sufficient. perhaps it's better to move that last part up to the first 'host *'
that file is provided by upstream. please take the matter to them.
