Re: [vserver] Virtual Host-Only Networking (tap?)

From: Eugen Leitl <eugen_at_leitl.org>
Date: Tue 14 Sep 2010 - 14:22:18 BST
Message-ID: <20100914132218.GA14773@leitl.org>

On Sat, Sep 11, 2010 at 11:14:45PM +0100, Gordan Bobic wrote:

> That's mainly why I was asking about guests' access to services running
> on loopback on the host. But then again, I see no reason why the
> loopback interface on the host couldn't be suitably firewalled to
> prevent the obvious problems. I was just wondering if there is something
> obscure yet dangerous about this sort of a setup in terms of security.

Anecdotally, VServer seems to somewhat intrinsically harden the system.
I had a vserver recently host lock up semi-randomly, with error mentioning "exploit"
(I did not read it thorougly at the time).

Then I got abuse complaint about a brute-force ssh bot on one of the
guests (the vector was vulnerability in an old package installed by the
customer), and figured out they were probably attempting privilege
elevation exploits or similar, which didn't work on the vserver patched
kernels. As far as I know the host wasn't compromised, just the guest.

-- 
Eugen* Leitl leitl http://leitl.org
______________________________________________________________
ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org
8B29F6BE: 099D 78BA 2FD3 B014 B08A  7779 75B0 2443 8B29 F6BE
Received on Tue Sep 14 14:23:00 2010
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Tue 14 Sep 2010 - 14:23:01 BST by hypermail 2.1.8