On Mon, Feb 23, 2009 at 10:45:52AM +1300, Corin Langosch wrote: > On 23.02.2009 06:32, Michael S. Zick wrote: > > In general, that is just the way "host local" is done in the network > > stack. "host" here being the usage in network terminology. Both > > "127.0.0.1" and the assigned machine IP address the same machine > > Call it a feature. > > In the newer VServer setups, you have the *option* to give each "guest" > > an "lo A.K.A: 127.0.0.0/8" interface. > > So, more info needed: > > what context where you in (VServer host or Vserver guest) when you > > typed the telnet command? > I did everything, except the tcpdump, from inside the same guest. > I just did it again and now the output looks even more strange > (to me): > firewall (dropped):IN=lo OUT= > MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=55.31.151.23 > DST=127.179.126.1 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=61080 DF PROTO=TCP > SPT=44517 DPT=4456 WINDOW=32792 RES=0x00 SYN URGP=0 > It seems the "real" IP of the guest is chosen this time to connect to > the local interface, not even a random 127.0.0.1/8 one. so? > > how did you configure the VServer kernel? Isolated lo or not? > I didn't build the kernel myself, I use the precompiled one from debian. > The config looks like this > ~# cat /boot/config-2.6.26-1-vserver-amd64 | grep -i vser > # Linux VServer > CONFIG_VSERVER_AUTO_LBACK=y > # CONFIG_VSERVER_AUTO_SINGLE is not set > CONFIG_VSERVER_COWBL=y > # CONFIG_VSERVER_VTIME is not set > # CONFIG_VSERVER_DEVICE is not set > CONFIG_VSERVER_PROC_SECURE=y > CONFIG_VSERVER_HARDCPU=y > CONFIG_VSERVER_IDLETIME=y > CONFIG_VSERVER_IDLELIMIT=y > CONFIG_VSERVER_PRIVACY=y > CONFIG_VSERVER_CONTEXTS=768 > CONFIG_VSERVER_WARN=y > # CONFIG_VSERVER_DEBUG is not set > CONFIG_VSERVER=y > CONFIG_VSERVER_SECURITY=y > Is it correct that 127.0.0.1/8 is local to each vserver nope, but 127.0.0.1/8 will be remapped to the lback address (which is unique for each context, unless you change it) > and so adding a general rule like > $IPTABLES -A INPUT -d 127.0.0.0/8 -i lo -j ACCEPT > is safe and doesn't expose any security flaws between > different vserver guests? what kind of 'security flaws' do you have to be exposed? best, Herbert > Thanks, > Corin