Thu, 26 Feb 2009 10:11:11 +1300
On 26.02.2009 07:03, Herbert Poetzl wrote:
> On Mon, Feb 23, 2009 at 10:45:52AM +1300, Corin Langosch wrote:
>
>> It seems the "real" IP of the guest is chosen this time to connect to
>> the local interface, not even a random 127.0.0.1/8 one.
>>
> so?
>
Well my firewall rule "-s 127.0.0.0/8 <http://127.0.0.0/8>" didn't work
anymore. And I found it quite weierd to see internal traffic originating
from an external interface.
>> $IPTABLES -A INPUT -d 127.0.0.0/8 -i lo -j ACCEPT is safe and doesn't expose any
security flaws between
>> different vserver guests?
>>
> what kind of 'security flaws' do you have to be exposed?
>
If I unterstand correctly and the traffic is only remapped and not
isolated, a guest can simply connect to another guest's local interface
by guessing (scanning) it's current local ip address? Obviously this
would be a real security flaw, as many daemons and poeple binding stuff
to 127.0.0.1 expect it to be a secure address and don't have extra auth
stuff in the protocol implemented or activated.
What's the best firewall rule to protect against this? I mean ex. "-s
127.1.2.3 -d 127.1.2.3" won't work because the traffic not always
originates from 127.1.2.3, but possible from any interface in the guest
(or whole host?)?
BTW: Thank's so far for all the other tipps. I updated my vserver config
and the sysctl stuff and didn't have any problems anymore.
Corin
On 26.02.2009 07:03, Herbert Poetzl wrote:
On Mon, Feb 23, 2009 at 10:45:52AM +1300, Corin Langosch wrote:
It seems the "real" IP of the guest is chosen this time to connect to
the local interface, not even a random 127.0.0.1/8 one.
so?
Well my firewall rule "-s
127.0.0.0/8"
didn't work anymore. And I found it quite weierd to see internal
traffic originating from an external interface.
$IPTABLES -A INPUT -d 127.0.0.0/8 -i lo -j ACCEPT is safe and doesn't expose any security flaws between
different vserver guests?
what kind of 'security flaws' do you have to be exposed?
If I unterstand correctly and the traffic is only remapped and not
isolated, a guest can simply connect to another guest's local interface
by guessing (scanning) it's current local ip address? Obviously this
would be a real security flaw, as many daemons and poeple binding stuff
to 127.0.0.1 expect it to be a secure address and don't have extra auth
stuff in the protocol implemented or activated.
What's the best firewall rule to protect against this? I mean ex. "-s
127.1.2.3 -d 127.1.2.3" won't work because the traffic not always
originates from 127.1.2.3, but possible from any interface in the guest
(or whole host?)?
BTW: Thank's so far for all the other tipps. I updated my vserver
config and the sysctl stuff and didn't have any problems anymore.
Corin