Subject: Re: [vserver] Re: simple 127.0.0.1 functionality
From: cuimalo <cuimalo@gmail.com>
Date: Tue, 19 Apr 2011 21:50:07 +0000

 Tue, 19 Apr 2011 21:50:07 +0000
Very well put. Special casing disabled. That led me into the real
problem: I had the host setup to use the IP addresses as well
preventing binding.

Thanks! Would you like me to wiki this?

On Mon, Apr 18, 2011 at 19:22, Herbert Poetzl <herbert@13thfloor.at> wrote:
> On Mon, Apr 18, 2011 at 10:31:00AM -0700, cuimalo wrote:
>> 'Automatically Assign Loopback IP' does in fact appear.
>> My loopback connections on vserver clients go to my host.
>
> when your 'loopback' connections end up on the host, then
> this means that the host is not properly restricted for
> that service, e.g. if you run sshd on the host, which
> binds to 0.0.0.0 (IP ADDR ANY) it will automatically
> intercept  any  ssh to  any  local address ...
>
> http://linux-vserver.org/Frequently Asked Questions
> (point 8.2)
>
>> How do I use the  'Remap Source IP Address' behavior?
>
> lback remapping will automatically map any 127.x.x.x
> address to the guest assigned lback address, which, when
> 'Automatically Assign Loopback IP' is enabled, will be
> configured to 127.x.y.1 where x.y is the context id
>
> also make sure that when you want loopback isolation
> that you disable the single ip special casing if your
> guest has just a single IP (besides lback) assigned,
> but that is not related to this problem :)
>
>> On Mon, Apr 18, 2011 at 10:15, cuimalo <cuimalo@gmail.com> wrote:
>>> My issue is that 'Remap Source IP Address' or 'Automatically Assign
>>> Loopback IP' do not appear as options in gentoo's menuconfig.
>
>>> On Mon, Apr 18, 2011 at 10:03, cuimalo <cuimalo@gmail.com> wrote:
>>>> Howdy,
>
>>>> Help me out and I'll write it up in the wiki!
>>>> I've checked the docs (briefly) and the google for this.
>>>> I basically need local telnet.
>
> so to recap, don't run a telnet server on the host, or
> if you need one, restrict it to the host-only IPs
> note: the guests are automatically restricted to the
> assigned subset, so no additional actions are required
> there ...
>
> HTH,
> Herbert
>
>>>> Thanks!
>
>
>>>> (title: simple 127.0.0.1 functionality)
>
>
>