Subject: Re: [vserver] network issues with lo interface
From: Corin Langosch <corinl@gmx.de>
Date: Thu, 26 Feb 2009 10:11:11 +1300
Thu, 26 Feb 2009 10:11:11 +1300
On 26.02.2009 07:03, Herbert Poetzl wrote:
> On Mon, Feb 23, 2009 at 10:45:52AM +1300, Corin Langosch wrote:
>   
>> It seems the "real" IP of the guest is chosen this time to connect to
>> the local interface, not even a random 127.0.0.1/8 one.
>>     
> so?
>   
Well my firewall rule "-s 127.0.0.0/8 <http://127.0.0.0/8>" didn't work
anymore. And I found it quite weierd to see internal traffic originating
from an external interface.
>> $IPTABLES -A INPUT -d 127.0.0.0/8 -i lo -j ACCEPT is safe and doesn't expose any
security flaws between 
>> different vserver guests?
>>     
> what kind of 'security flaws' do you have to be exposed?
>   
If I unterstand correctly and the traffic is only remapped and not
isolated, a guest can simply connect to another guest's local interface
by guessing (scanning) it's current local ip address? Obviously this
would be a real security flaw, as many daemons and poeple binding stuff
to 127.0.0.1 expect it to be a secure address and don't have extra auth
stuff in the protocol implemented or activated.

What's the best firewall rule to protect against this? I mean ex. "-s
127.1.2.3 -d 127.1.2.3" won't work because the traffic not always
originates from 127.1.2.3, but possible from any interface in the guest
(or whole host?)?

BTW: Thank's so far for all the other tipps. I updated my vserver config
and the sysctl stuff and didn't have any problems anymore.

Corin



On 26.02.2009 07:03, Herbert Poetzl wrote:
On Mon, Feb 23, 2009 at 10:45:52AM +1300, Corin Langosch wrote:
  
It seems the "real" IP of the guest is chosen this time to connect to
the local interface, not even a random 127.0.0.1/8 one.
    
so?
  
Well my firewall rule "-s 127.0.0.0/8" didn't work anymore. And I found it quite weierd to see internal traffic originating from an external interface.
$IPTABLES -A INPUT -d 127.0.0.0/8 -i lo -j ACCEPT is safe and doesn't expose any security flaws between 
different vserver guests?
    
what kind of 'security flaws' do you have to be exposed?
  
If I unterstand correctly and the traffic is only remapped and not isolated, a guest can simply connect to another guest's local interface by guessing (scanning) it's current local ip address? Obviously this would be a real security flaw, as many daemons and poeple binding stuff to 127.0.0.1 expect it to be a secure address and don't have extra auth stuff in the protocol implemented or activated.

What's the best firewall rule to protect against this? I mean ex. "-s 127.1.2.3 -d 127.1.2.3" won't work because the traffic not always originates from 127.1.2.3, but possible from any interface in the guest (or whole host?)?

BTW: Thank's so far for all the other tipps. I updated my vserver config and the sysctl stuff and didn't have any problems anymore.

Corin