Re: [vserver] Linux-Vserver hide network information

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Mon 12 Dec 2011 - 13:18:12 GMT
Message-ID: <20111212131812.GK6554@MAIL.13thfloor.at>

On Mon, Dec 12, 2011 at 02:11:44PM +0100, Laurens Vets wrote:
> Hello,

>>> Is it possible to hide all net related information
>>> in a vserver guest from regular users?

>> do I get that right that you want to block any non-root
>> user from accessing any information regarding the network
>> setup?

> Yes, that is correct.

>>> Also, is it possible to shield /proc from regular
>>> users?

>> and the same here for /proc access in general?

>> if so, then yes, it's possible, but it is definitely
>> not implemented in Linux-VServer and I doubt that it will
>> leave anything 'working', because /proc and some parts
>> of netlink are used all the time ...

>> please try to give some more information what you are
>> trying to accomplish ...

> The main reasoning behind this is to make a machine invisible
> (network-wise) to a user. For example, suppose I'm running a
> chrooted Tor relay node in Linux-VServer and this specific
> machine gets compromised by someone on the Tor network and he
> now has local shell access.

> Can Linux-VServer be configured in such a way that the user
> cannot determine the actual ip address of the machine?

configured?
no, that's definitely not something you use/want/need in
normal guest setups (besides the fact that it would be kind
of tricky to do at all)

I'm not saying it's not possible to do, but the actual
usecases are quite rare and outside the scope of Linux-VServer

have you considered using a private IP and doing s/d-nat
instead? that will 'hide' the 'real' IP from any guest user
but please note that as long as the guest has network access,
a simple syn packet to a known host will reveal the real IP

best,
Herbert
Received on Mon Dec 12 13:18:22 2011

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Mon 12 Dec 2011 - 13:18:22 GMT by hypermail 2.1.8