From: Ulrich Weber (mail_at_nibbler.net)
Date: Thu 17 Mar 2005 - 21:42:17 GMT
Herbert Poetzl wrote:
>On Thu, Mar 17, 2005 at 03:49:53PM +0100, Ulrich Weber wrote:
>
>
>>Well you could do as normal user all the things ICMP is good for.
>>See http://www.faqs.org/docs/iptables/icmptypes.html for all types.
>>
>>This could be Source redirection. However that should be disabled on
>>most systems for security reasons.
>>
>>Thats IMHO the only thing evil users good do. All other ICMP types make
>>no sense, because the user is not
>>able to sniff the packets and therefore can not "react" to incoming
>>packets with custom ICMP replys.
>>
>>
>
>what about various DoS and DDoS things like sending
>host unreachable for the 'neighbour' vserver's ip ...
>
>
>
Is it possible to send packets with other IPs than the of the origin
vserver?
Should/Can this not be disabled by the vserver patch generally ?
>>I would recommend to use this as default behavior. For high security you
>>could disable this feature and for low
>>security you could enable the CAP_NET_RAW mode.
>>
>>
>
>carefully, CAP_NET_RAW gives you the ability to sniff
>all kinds of traffic too ...
>
>
>
Yeah thats exactly the problem wit my vserver provider. They enabled
this to use ping on all vserver
because more customers cared about ping than about sniffing the traffic...
>>You also have to consider that normally users on vservers are trusted so
>>its not really a multi-user environment.
>>
>>
>
>hmm, they are? ;)
>
>
>
Yeah, who wants this should rent a dedicated server ;)
_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver