Subject: Re: [vserver] Using nmap
From: Nikolay Kichukov <hijacker@oldum.net>
Date: Mon, 22 Jun 2009 10:30:23 +0300

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi John,
You can take advantage of the vattribute command, so that you
enable/disable capabilities on the fly.

Cheers,
- -Nik

John Alberts wrote:
> On Fri, Jun 19, 2009 at 9:38 AM, John Alberts<john.m.alberts@gmail.com> wrote:
> 
>> I've never used any of the capability flags.  Is there any way I can
>> allow this by adding a capability for this guest.  I realize allowing
>> raw net access is not a good idea, but I would just like to enable it
>> temporarily so I can run a utility in the guest one time that requires
>> nmap.  Then I'll just remove the capability.
> 
> Sorry.  Please ignore my rambling.  I saw the documentation on the
> wiki, but I was a little weary of trying it on my production server.
> I added NET_ADMIN, NET_RAW, NET_BROADCAST and NET_BIND_SERVICE to
> /etc/vservers/guestname/bcapabilities and restarted the guest.  Nmap
> works great now and I just removed the bacpabilities and restarted the
> server again, since I don't need nmap again.
> I know I probably added more capabilities than I needed, but it was
> only temporary.
> 
> Regards,
> John
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQEcBAEBAgAGBQJKPzMOAAoJEDFLYVOGGjgXOHsIALloF/ZieGwQJDoJFeFYt1Un
s7qPSkMkaF6mwzs6QHra2DoYRln51vBRaMCejoCp/6fWm97FVGLBDrQWoVDifZiR
uR+WpogngHJgLjBlR2F9h50ATjeQLiQgH8hoNQAR0SKtK8/d8QP8wvplNJ2vSrfm
efxqnDOLpPswJxIDZlD8FDPeI35bYy/m4y9NtNkXomoe17MDHc6sYNn7G+5pmCyv
hHMQcO6m/SCQF/2nTueKRM5woXQmfQJV89xUdgcpQNzIcee+lP8crbtsxfTcxeP5
cir8fXlp0I88JFyNuIZUb2MGwmFylxbiIZ0TAL5AG8nREL08cTXpKl110Dh1C/Y=
=S3Yu
-----END PGP SIGNATURE-----