Hi All: I am interested in this thread particularly from the perspective of some more general (newbie) security questions, and was hoping for some input: - How easy is it for viruses or attackers to compromise a vserver guest? I know that's a broad question, but how would it occur: * if there is no root access in a guest, and guest users have no access to a command prompt (because it's been disabled).....but ssh is running on the guest... * or same scenario, but there's a desktop: users can't double click on code to execute it, but there is a browser (say no java for the sake of this example) - Would the compromise occur primarily because of inherent exploits in OS, code which is employed both in the host and guests? - would an attack most likely come from between guests, or from the host getting compromised? Again, in an overly broad sense, are attacks statistically most likely to come from a browser (either in the guest or the host)? - is running an AV on the host against guests effective, or is it "best practice" to run an AV in each guest? I am working under the assumption that guests are very hard to compromise, even from phishing and common user mistakes. Is that a correct assumption? Any feedback appreciated. On 10/04/14 11:51, Herbert Poetzl wrote: > On Sat, Oct 04, 2014 at 03:46:10PM +0100, Phil Daws wrote: > >> Yeah, lol ... but that is the only error I could see and >> what is odd is that both Kaspersky and ESET show similar >> symptoms. >> > Maybe those are basically the same software, who knows > who stole from whom there :) > > >> And indeed ClamAV and AVG both are absolutely fine. >> > Why not ask the Kaspersky/ESET support what this error > actually means? > > Best, > Herbert > > >> Very weird. >> > >> ----- Original Message ----- >> From: "Herbert Poetzl"<herbert@13thfloor.at> >> To: "Phil Daws"<uxbod@splatnix.net> >> Cc: vserver@list.linux-vserver.org >> Sent: Saturday, 4 October, 2014 2:40:59 PM >> Subject: Re: [vserver] Virus scanning on a guest >> > >> On Sat, Oct 04, 2014 at 08:50:41AM +0100, Phil Daws wrote: >> >>> Have straced the eset daemon on start and it appears to be failing here: >>> > >>> munmap(0xf750f000, 4096) = 0 >>> open("/var/opt/eset/esets/lib/em001_32.dat", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) >>> munmap(0xf74f6000, 102400) = 0 >>> write(2, "error[38440000]: Cannot initiali"..., 69error[38440000]: Cannot initialize scanner: No such file or directory) = 69 >>> write(2, "\n", 1 >>> ) >>> > >>> and the file does exist: >>> > >>> ls -l /var/opt/eset/esets/lib/em000_32.dat >>> -rw-r--r-- 1 root root 55888 Oct 2 15:52 /var/opt/eset/esets/lib/em000_32.dat >>> > >> This is a different file (em000 vs em001) >> > >>> Any ideas please ? >>> > >> Best, >> Herbert >> > >>> ----- Original Message ----- >>> From: "Herbert Poetzl"<herbert@13thfloor.at> >>> To: "Phil Daws"<uxbod@splatnix.net> >>> Cc: vserver@list.linux-vserver.org >>> Sent: Friday, 3 October, 2014 6:38:00 PM >>> Subject: Re: [vserver] Virus scanning on a guest >>> > >>> On Fri, Oct 03, 2014 at 05:37:11PM +0100, Phil Daws wrote: >>> >>>> Hello: >>>> > >>>> has anybody been able to get virus scanning running under >>>> a vserver guest ? Yesterday I tried ESET and Kaspersky >>>> with the following errors: >>>> > >>>> service esets start >>>> Starting ESET Securityerror[25340000]: Cannot initialize >>>> scanner: No such file or directory [FAILED] >>>> > >>>> /opt/kaspersky/kav4fs/bin/kav4fs-control --scan-file /tmp >>>> Couldn't scan file /tmp >>>> Description: Operation isn't allowed >>>> > >>> First /tmp is not a file, it is a mount point (at least >>> on typical Unix/Linux distributions), and the question >>> here is how your /tmp is mounted (which might be too >>> restrictive, for security reasons, on this guest) >>> > >>>> I even gave my guest : >>>> > >>>> cat bcapabilities >>>> NET_RAW >>>> SYS_ADMIN >>>> > >>> Those are definitely not required for a simple task like >>> virus scanning and I would strongly suggest not to give >>> that to a guest with a focus on security ... >>> > >>>> any ideas please ? Thanks, P. >>>> > >>> First, check the mount options, then check with e.g. >>> strace -fF what the kaspersky tool is trying to do and >>> what actually fails. >>> > >>> HTH, >>> Herbert >>>