Re: [vserver] Vservers on Slackware

From: Laurens Vets <laurens_at_daemon.be>
Date: Tue 27 Apr 2010 - 13:05:09 BST
Message-ID: <4BD6D2F5.1020207@daemon.be>

Hello all,

I'm in the process of updating all my VServer Slackware scripts and
vservers. The host has been upgraded to 2.6.32 with
grsec2.1.14-vs2.3.0.36.29.4 and util-vserver 0.30.216-pre2883.

However, I have some additional questions before I write out the guide :)

On 8/24/2008 8:00 PM, Herbert Poetzl wrote:
<snip>
>>>> The next command will create a new skeleton vserver under
>>>> /vservers/vserver1 with the necessary devices:
>>>>
>>>> # NAME=vserver1
>>>> # INTERFACE=eth0:10.0.0.1/24
>>>> # CONTEXT=1000
>>>> # vserver ${NAME} build -m skeleton --context ${CONTEXT} --interface
>>>> ${INTERFACE} --flags
>>>> lock,virt_mem,virt_uptime,virt_cpu,virt_load,sched_hard,hide_netif
>>>> --initstyle sysv
>>>
>>> you don't want to give all those flags, as
>>> some of them are default anyway, and others
>>> are left-overs from ancient times :)
>>
>> For the flags, only lock seems to be needed?
>> Also, what exactly does private do?
>> Does it prevent the root from the host system to enter the vserver?
>
> http://linux-vserver.org/Capabilities_and_Flags
>
> note that the flags tagged with 'L' are legacy
> flags and you don't want them with Linux-VServer
> 2.0 or later (legacy means 1.x :)

What are the default flags now with 2.3?

<snip>
>>>> At this point you can start "netconfig" and start configuring your
>>>> newly created Slackware 12.0 VServer. It?s probably a good idea to
have
>>>> a 'localhost' in your vserver. This can be achieved by creating a new
>>>> folder in /etc/vservers/${NAME}/interfaces/. Name the folder 1, if the
>>>> previous one that exists there is 0. Then create files named ?ip?,
>>>> ?dev? and ?prefix? and write 127.0.0.1 to ip, lo to dev and 32 to
>>>> prefix:
>>>
>>> don't do that, it will break a lot of things
>>> (and make your guest insecure)
>>
>> How does it make the guest insecure?
>
> well, the guest and the host will magically share
> the loopback address now, and thus the guest will
> be able to bind ports the host services are using,
> and to receive data or even block service which
> belong to the host

Is this still a problem when you have configured the lback feature in
the kernel?

>>> if you are with vs2.0-vs2.2, you want to change
>>> /etc/hosts to contain something like
>>>
>>> <guest-ip> localhost localhost.localdomain
>>>
>>> if you are with vs2.3, enable the lback feature
>>> and you'll get a private 127.0.0.1 for your guest
>>
>> And how do I add the ip addresses or is adding them with
>> the "vserver build ..." command enough?
>
> you can specify all the addresses at build time
> or runtime or in the config
>
>>>> # mkdir /etc/vservers/${NAME}/interfaces/1/
>>>> # echo 127.0.0.1> /etc/vservers/${NAME}/interfaces/1/ip
>>>> # echo 32> /etc/vservers/${NAME}/interfaces/1/prefix
>>>> # echo lo> /etc/vservers/${NAME}/interfaces/1/dev
>>>
>>> again, don't do that if you do not exactly know
>>> the implications

Is this still a problem when you add the lback feature?
Received on Tue Apr 27 13:05:33 2010

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Tue 27 Apr 2010 - 13:05:34 BST by hypermail 2.1.8