Re: [vserver] vserver security

From: Giovanni Di Stasi <>
Date: Thu 15 May 2008 - 23:25:07 BST
Message-Id: <>

Il Friday 16 May 2008 00:19:38 Oliver Welter ha scritto:
> Hi Giovanni,
> | If a have a service running in a vserver, and this service get
> compromised by
> | an attacker, is the attacker confined to the vserver, so that he/she
> can't
> | compromise any of the other services (running in other vservers), and
> he/she
> | can't modify files outside the filesystem of the compromised vserver?
> A user inside the vserver has access to the filesystem and the processes
> inside the vserver. If your setup does not share any resources between
> more than one vserver, it is not possible for a user (attacker or legal
> user - doesn't matter) to access filesystem resources outside the guest,
> as long as you do not give special capabilities to the guest which
> enable it to access kernel devices directly.
> There might be the change that the process/resource isolation code of
> vserver itself has bugs - in this case you will obvioulsy loose this
> security.
> | Is a vserver context more secure than a chroot jail?
> AFAIK a jail hides the filesystem but not processes - so I would give a
> yes at least regarding this issue.
> Oliver

would you implement a server to give a few services (dns, webserver, dhcp,
etc.) putting each of these services in a different vserver, just to have a
system more secure?

What do you think about having a ssh server in each vserver and not in the
main context? Is this setup more secure?

Received on Thu May 15 23:25:26 2008

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Thu 15 May 2008 - 23:25:28 BST by hypermail 2.1.8