Hello all, I'm in the process of updating all my VServer Slackware scripts and vservers. The host has been upgraded to 2.6.32 with grsec2.1.14-vs2.3.0.36.29.4 and util-vserver 0.30.216-pre2883. However, I have some additional questions before I write out the guide :) On 8/24/2008 8:00 PM, Herbert Poetzl wrote: <snip> >>>> The next command will create a new skeleton vserver under >>>> /vservers/vserver1 with the necessary devices: >>>> >>>> # NAME=vserver1 >>>> # INTERFACE=eth0:10.0.0.1/24 >>>> # CONTEXT=1000 >>>> # vserver ${NAME} build -m skeleton --context ${CONTEXT} --interface >>>> ${INTERFACE} --flags >>>> lock,virt_mem,virt_uptime,virt_cpu,virt_load,sched_hard,hide_netif >>>> --initstyle sysv >>> >>> you don't want to give all those flags, as >>> some of them are default anyway, and others >>> are left-overs from ancient times :) >> >> For the flags, only lock seems to be needed? >> Also, what exactly does private do? >> Does it prevent the root from the host system to enter the vserver? > > http://linux-vserver.org/Capabilities_and_Flags > > note that the flags tagged with 'L' are legacy > flags and you don't want them with Linux-VServer > 2.0 or later (legacy means 1.x :) What are the default flags now with 2.3? <snip> >>>> At this point you can start "netconfig" and start configuring your >>>> newly created Slackware 12.0 VServer. It?s probably a good idea to have >>>> a 'localhost' in your vserver. This can be achieved by creating a new >>>> folder in /etc/vservers/${NAME}/interfaces/. Name the folder 1, if the >>>> previous one that exists there is 0. Then create files named ?ip?, >>>> ?dev? and ?prefix? and write 127.0.0.1 to ip, lo to dev and 32 to >>>> prefix: >>> >>> don't do that, it will break a lot of things >>> (and make your guest insecure) >> >> How does it make the guest insecure? > > well, the guest and the host will magically share > the loopback address now, and thus the guest will > be able to bind ports the host services are using, > and to receive data or even block service which > belong to the host Is this still a problem when you have configured the lback feature in the kernel? >>> if you are with vs2.0-vs2.2, you want to change >>> /etc/hosts to contain something like >>> >>> <guest-ip> localhost localhost.localdomain >>> >>> if you are with vs2.3, enable the lback feature >>> and you'll get a private 127.0.0.1 for your guest >> >> And how do I add the ip addresses or is adding them with >> the "vserver build ..." command enough? > > you can specify all the addresses at build time > or runtime or in the config > >>>> # mkdir /etc/vservers/${NAME}/interfaces/1/ >>>> # echo 127.0.0.1> /etc/vservers/${NAME}/interfaces/1/ip >>>> # echo 32> /etc/vservers/${NAME}/interfaces/1/prefix >>>> # echo lo> /etc/vservers/${NAME}/interfaces/1/dev >>> >>> again, don't do that if you do not exactly know >>> the implications Is this still a problem when you add the lback feature?