Subject: Re: [vserver] Vservers on Slackware
From: Laurens Vets <laurens@daemon.be>
Date: Tue, 27 Apr 2010 14:05:09 +0200

Hello all,

I'm in the process of updating all my VServer Slackware scripts and 
vservers. The host has been upgraded to 2.6.32 with 
grsec2.1.14-vs2.3.0.36.29.4 and util-vserver 0.30.216-pre2883.

However, I have some additional questions before I write out the guide :)

On 8/24/2008 8:00 PM, Herbert Poetzl wrote:
<snip>
 >>>> The next command will create a new skeleton vserver under
 >>>> /vservers/vserver1 with the necessary devices:
 >>>>
 >>>> # NAME=vserver1
 >>>> # INTERFACE=eth0:10.0.0.1/24
 >>>> # CONTEXT=1000
 >>>> # vserver ${NAME} build -m skeleton --context ${CONTEXT} --interface
 >>>> ${INTERFACE} --flags
 >>>> lock,virt_mem,virt_uptime,virt_cpu,virt_load,sched_hard,hide_netif
 >>>> --initstyle sysv
 >>>
 >>> you don't want to give all those flags, as
 >>> some of them are default anyway, and others
 >>> are left-overs from ancient times :)
 >>
 >> For the flags, only lock seems to be needed?
 >> Also, what exactly does private do?
 >> Does it prevent the root from the host system to enter the vserver?
 >
 > http://linux-vserver.org/Capabilities_and_Flags
 >
 > note that the flags tagged with 'L' are legacy
 > flags and you don't want them with Linux-VServer
 > 2.0 or later (legacy means 1.x :)

What are the default flags now with 2.3?

<snip>
 >>>> At this point you can start "netconfig" and start configuring your
 >>>> newly created Slackware 12.0 VServer. It?s probably a good idea to 
have
 >>>> a 'localhost' in your vserver. This can be achieved by creating a new
 >>>> folder in /etc/vservers/${NAME}/interfaces/. Name the folder 1, if the
 >>>> previous one that exists there is 0. Then create files named ?ip?,
 >>>> ?dev? and ?prefix? and write 127.0.0.1 to ip, lo to dev and 32 to
 >>>> prefix:
 >>>
 >>> don't do that, it will break a lot of things
 >>> (and make your guest insecure)
 >>
 >> How does it make the guest insecure?
 >
 > well, the guest and the host will magically share
 > the loopback address now, and thus the guest will
 > be able to bind ports the host services are using,
 > and to receive data or even block service which
 > belong to the host

Is this still a problem when you have configured the lback feature in 
the kernel?

 >>> if you are with vs2.0-vs2.2, you want to change
 >>> /etc/hosts to contain something like
 >>>
 >>> <guest-ip>  localhost localhost.localdomain
 >>>
 >>> if you are with vs2.3, enable the lback feature
 >>> and you'll get a private 127.0.0.1 for your guest
 >>
 >> And how do I add the ip addresses or is adding them with
 >> the "vserver build ..." command enough?
 >
 > you can specify all the addresses at build time
 > or runtime or in the config
 >
 >>>> # mkdir /etc/vservers/${NAME}/interfaces/1/
 >>>> # echo 127.0.0.1>  /etc/vservers/${NAME}/interfaces/1/ip
 >>>> # echo 32>  /etc/vservers/${NAME}/interfaces/1/prefix
 >>>> # echo lo>  /etc/vservers/${NAME}/interfaces/1/dev
 >>>
 >>> again, don't do that if you do not exactly know
 >>> the implications

Is this still a problem when you add the lback feature?