Re: [vserver] Networking questions

From: Siv <punumaa_at_gmail.com>
Date: Wed 23 Jun 2010 - 09:13:54 BST
Message-ID: <AANLkTikEP56ZYZZrizvgK4CnUC2YbNRAI2ryPVcxWRD0@mail.gmail.com>

Thanks. Some behaviors I noticed :

1. I can ssh into the host providing the ip address of the guest i.e ssh
root@guest gets me into the host. I hope this is not by design.
2. I have two guests and while running "ifconfig" from host, shows the ip
address of only one guest. The other guest's info is missing.

Am running 2.6.32.13-vs2.3.0.36.29.4

--Siv

On Tue, Jun 22, 2010 at 6:27 PM, Mark Little <marklittle@koallo.com> wrote:

> On 22/06/2010 7:27 PM, Herbert Poetzl wrote:
>
>> On Mon, Jun 21, 2010 at 10:35:36PM -0700, Siv wrote:
>>
>>> My requirement is to allow different routing table for the
>>> guest and host.
>>> Is that possible?
>>>
>> yes, if you want performance, use multiple routing tables
>> and select them based on the source IP, if you don't care
>> about performance, check out the network namespaces, they
>> will allow you to have 'virtual' network spaces
>>
>> Please let me know,
>>>
>> best,
>> Herbert
>>
>
> Hi Herbert,
>
> On a related note - I was wondering if you could let me know if what I am
> seeing is normal or I have broken my vserver config somehow..
>
> Kernel: 2.6.31.13-vs2.3.0.36.28.2-beng
> VS-API: 0x00020305
> util-vserver: 0.30.216-pre2883; Apr 28 2010, 15:36:17
>
> I currently utilize source routing using the iproute2 system, however I was
> wondering if its normal for the guests to be able able to see all the rules
> and routes even if they do not apply to them.
>
> 'ip addr ls' only shows the assigned interfaces, however 'ip route ls'
> shows extra routes which give away the source IP.
>
> eg:
>
> [gizmo1:~]# ip addr ls
> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
> link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
> inet 127.0.0.1/8 scope host lo
> 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state
> UP qlen 1000
> link/ether 00:0d:60:9c:37:82 brd ff:ff:ff:ff:ff:ff
> inet 10.1.1.20/24 brd 10.1.1.255 scope global secondary eth0
> inet xxx.xxx.194.119/27 brd xxx.xxx.194.127 scope global secondary eth0
>
> [gizmo1:~]# ip route ls
> xxx.xxx.194.96/27 dev eth0 proto kernel scope link src xxx.xxx.194.113
> xxx.xxx.201.128/25 dev eth0 proto kernel scope link src xxx.xxx.201.162
> xxx.xxx.219.0/24 dev eth0 proto kernel scope link src xxx.xxx.219.34
> xxx.xxx.194.0/24 dev eth0 proto kernel scope link src xxx.xxx.194.118
> 10.1.1.0/24 dev eth0 proto kernel scope link src 10.1.1.36
> default via xxx.xxx.194.97 dev eth0 src xxx.xxx.194.113
>
> [gizmo1:~]# ip rule ls
> 0: from all lookup local
> 9999: from 10.1.1.0/24 to xxx.xxx.194.0/24 lookup 203
> 20000: from xxx.xxx.194.118 lookup 204
> 20000: from xxx.xxx.194.119 lookup 205
> 20000: from xxx.xxx.194.125 lookup 210
> 20000: from xxx.xxx.201.162 lookup 210
> 20000: from xxx.xxx.219.34 lookup 210
> 20000: from xxx.xxx.219.202 lookup 210
> 32766: from all lookup main
> 32767: from all lookup default
> [root@gizmo1:~]#
>
> It's not a huge issue for us at the moment as most of the our vserver
> guests are internal servers - however we were looking at offering it as a
> service, which means now I have to worry more about security.
>
> I will look into the network namespaces as that may be the safest option
> for those specific servers, but I just wanted to make sure I haven't done
> something wrong along the way which is allowing this information to be
> shown.
>
>
> Regards,
> Mark
>
>
>
>
>
Received on Wed Jun 23 09:18:24 2010

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 23 Jun 2010 - 09:18:29 BST by hypermail 2.1.8