Re: [vserver] Virus scanning on a guest

From: Madog <madogdevelopment_at_gmail.com>
Date: Sun 05 Oct 2014 - 12:45:57 BST
Message-ID: <54312F75.4020001@gmail.com>

Hi All:

I am interested in this thread particularly from the perspective of some
more general (newbie) security questions, and was hoping for some input:

- How easy is it for viruses or attackers to compromise a vserver
guest? I know that's a broad question, but how would it occur:

* if there is no root access in a guest, and guest users have no access
to a command prompt (because it's been disabled).....but ssh is running
on the guest...

* or same scenario, but there's a desktop: users can't double click on
code to execute it, but there is a browser (say no java for the sake of
this example)

- Would the compromise occur primarily because of inherent exploits in
OS, code which is employed both in the host and guests?

- would an attack most likely come from between guests, or from the host
getting compromised? Again, in an overly broad sense, are attacks
statistically most likely to come from a browser (either in the guest or
the host)?

- is running an AV on the host against guests effective, or is it "best
practice" to run an AV in each guest?

I am working under the assumption that guests are very hard to
compromise, even from phishing and common user mistakes. Is that a
correct assumption? Any feedback appreciated.

On 10/04/14 11:51, Herbert Poetzl wrote:
> On Sat, Oct 04, 2014 at 03:46:10PM +0100, Phil Daws wrote:
>
>> Yeah, lol ... but that is the only error I could see and
>> what is odd is that both Kaspersky and ESET show similar
>> symptoms.
>>
> Maybe those are basically the same software, who knows
> who stole from whom there :)
>
>
>> And indeed ClamAV and AVG both are absolutely fine.
>>
> Why not ask the Kaspersky/ESET support what this error
> actually means?
>
> Best,
> Herbert
>
>
>> Very weird.
>>
>
>> ----- Original Message -----
>> From: "Herbert Poetzl"<herbert@13thfloor.at>
>> To: "Phil Daws"<uxbod@splatnix.net>
>> Cc: vserver@list.linux-vserver.org
>> Sent: Saturday, 4 October, 2014 2:40:59 PM
>> Subject: Re: [vserver] Virus scanning on a guest
>>
>
>> On Sat, Oct 04, 2014 at 08:50:41AM +0100, Phil Daws wrote:
>>
>>> Have straced the eset daemon on start and it appears to be failing here:
>>>
>
>>> munmap(0xf750f000, 4096) = 0
>>> open("/var/opt/eset/esets/lib/em001_32.dat", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)
>>> munmap(0xf74f6000, 102400) = 0
>>> write(2, "error[38440000]: Cannot initiali"..., 69error[38440000]: Cannot initialize scanner: No such file or directory) = 69
>>> write(2, "\n", 1
>>> )
>>>
>
>>> and the file does exist:
>>>
>
>>> ls -l /var/opt/eset/esets/lib/em000_32.dat
>>> -rw-r--r-- 1 root root 55888 Oct 2 15:52 /var/opt/eset/esets/lib/em000_32.dat
>>>
>
>> This is a different file (em000 vs em001)
>>
>
>>> Any ideas please ?
>>>
>
>> Best,
>> Herbert
>>
>
>>> ----- Original Message -----
>>> From: "Herbert Poetzl"<herbert@13thfloor.at>
>>> To: "Phil Daws"<uxbod@splatnix.net>
>>> Cc: vserver@list.linux-vserver.org
>>> Sent: Friday, 3 October, 2014 6:38:00 PM
>>> Subject: Re: [vserver] Virus scanning on a guest
>>>
>
>>> On Fri, Oct 03, 2014 at 05:37:11PM +0100, Phil Daws wrote:
>>>
>>>> Hello:
>>>>
>
>>>> has anybody been able to get virus scanning running under
>>>> a vserver guest ? Yesterday I tried ESET and Kaspersky
>>>> with the following errors:
>>>>
>
>>>> service esets start
>>>> Starting ESET Securityerror[25340000]: Cannot initialize
>>>> scanner: No such file or directory [FAILED]
>>>>
>
>>>> /opt/kaspersky/kav4fs/bin/kav4fs-control --scan-file /tmp
>>>> Couldn't scan file /tmp
>>>> Description: Operation isn't allowed
>>>>
>
>>> First /tmp is not a file, it is a mount point (at least
>>> on typical Unix/Linux distributions), and the question
>>> here is how your /tmp is mounted (which might be too
>>> restrictive, for security reasons, on this guest)
>>>
>
>>>> I even gave my guest :
>>>>
>
>>>> cat bcapabilities
>>>> NET_RAW
>>>> SYS_ADMIN
>>>>
>
>>> Those are definitely not required for a simple task like
>>> virus scanning and I would strongly suggest not to give
>>> that to a guest with a focus on security ...
>>>
>
>>>> any ideas please ? Thanks, P.
>>>>
>
>>> First, check the mount options, then check with e.g.
>>> strace -fF what the kaspersky tool is trying to do and
>>> what actually fails.
>>>
>
>>> HTH,
>>> Herbert
>>>
Received on Sun Oct 5 12:46:22 2014

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Sun 05 Oct 2014 - 12:46:22 BST by hypermail 2.1.8