Subject: Re: [vserver] Virtual Host-Only Networking (tap?)
From: Eugen Leitl <eugen@leitl.org>
Date: Tue, 14 Sep 2010 15:22:18 +0200

On Sat, Sep 11, 2010 at 11:14:45PM +0100, Gordan Bobic wrote:

> That's mainly why I was asking about guests' access to services running 
> on loopback on the host. But then again, I see no reason why the 
> loopback interface on the host couldn't be suitably firewalled to 
> prevent the obvious problems. I was just wondering if there is something 
> obscure yet dangerous about this sort of a setup in terms of security.

Anecdotally, VServer seems to somewhat intrinsically harden the system.
I had a vserver recently host lock up semi-randomly, with error mentioning "exploit"
(I did not read it thorougly at the time).

Then I got abuse complaint about a brute-force ssh bot on one of the
guests (the vector was vulnerability in an old package installed by the
customer), and figured out they were probably attempting privilege
elevation exploits or similar, which didn't work on the vserver patched
kernels. As far as I know the host wasn't compromised, just the guest.

-- 
Eugen* Leitl <a href="leitlhttp://leitl.org">leitl</a> http://leitl.org
______________________________________________________________
ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org
8B29F6BE: 099D 78BA 2FD3 B014 B08A  7779 75B0 2443 8B29 F6BE