Subject: Re: [vserver] Adding IPs to a vhost interface on demand
From: "Michael S. Zick" <mszick@morethan.org>
Date: Mon, 22 Dec 2008 15:27:36 -0600

On Mon December 22 2008, Ed W wrote:
> Peter Sabaini wrote:
> > On Sunday 21 December 2008 00:58:40 Ed W wrote:
> >   
> >> Hi, interested in putting openvpn in a vhost.  Previously I had a
> >> bridged setup with the openvpn server dynamically picking up IP
> >> addresses from the DHCP server and allocating those to the clients.
> >>
> >> Just for kicks I am interested to see if I can achieve something similar
> >> in a vserver.  Any thoughts on the best way to proceed?  Is it possible
> >> to give a guest permission to add IP address aliases dynamically?  The
> >> other option (for this small setup) is presumably to allocate X IPs to
> >> the guest in advance and just limit it to handing out these. (and routed
> >> is yet another option, but for the moment I am trying to make a bridged
> >> setup work)
> >>
> >> Any tips on a bridged openvpn vserver?
> >>
> >> Thanks
> >>
> >> Ed W
> >>     
> >
> > Don't know if this answers your question -- I had a similar task some time ago 
> > (assign IPs after vserver startup, in a failover-scenario) and received some 
> > suggestions here: http://archives.linux-vserver.org/200611/0080.html 
> >   
> 
> Possibly I missed the point, but I think that thread only covers adding 
> extra IPs from the outside of the vserver, not from the inside?  In this 
> case I was thinking about trying to have the vserver add extra IPs 
> dynamically - anyone know if this is possible?
> 

Anything is possible. ;)

By design, the hardware (and networking interface setup counts) is the 
responsibility of the "host" context.
Unless, of course, you change the guest's capabilities set, I will ignore that choice.

Use some meathod of requesting that the host execute the "add IP" command you want run.

Such as (vary to taste for your security flavor):

*) Create a user on the guest - purpose is as a "container" for the following -
Make this user as secure a holder of files as required (ssh keys and script).

*) Script (see: man ssh):
ssh <whole bunch of options, use as required> host-username@host-name "ip add ..."
associate a set of keys for this purpose between the guest username and the host username.
(So your script does not have to supply a password to ssh)

sshd will run the "command text" through the shell on the host side
without "logging in" (into the remote system that is).
If your "command text" expects input on stdin - just feed it into ssh ( something |
ssh ...)
If your "command text" generates output on stdout - just read from ssh ( ssh ... | reader)

Your "command text" length can be whatever the command line length limit is on your
system.
(Thousands or tens of thousands of bytes - a very respectable sized script)

Enjoy.

Mike

> Thanks
> 
> Ed W
>