Subject: Re: [vserver] 3 basic questions
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Tue, 11 Aug 2009 14:01:21 +0200

On Tue, Aug 11, 2009 at 09:28:19AM +0200, Rik Bobbaers wrote:
> just my 2 cents here...

> if i say: i want to run X in a guest
> then the sollution: just run X on the host... is NOT a sollution.
> thSince at's not what i want!

let me add here that there is no problem with running
X (as in X11/Xorg :) in a guest, if X refers to some app
then it depends where you draw the line, because if you
do not draw the line, you end up with hardware virtualization
as not even KVM or Xen is able to run _any_ app you can
run on the host

> it's like saying: i want to walk to the grocery store, but don't 
> know which way to go and someone says: take the car

maybe he says: better take the car, because the next one
is 100 miles away, and describing the way to you wold be
a horror :)

> it's possible, but not a sollution to a problem!
> and all to often i see that kind of sollution pass here.

> e.g. i want to rent a guest "machine" to people but can't be bothered 
> with how/what they firewall, then i want them to be able te make 
> sure it's firewalled (or not). and i don't care if that's bad practice 
> or not. i just want iptables in my guests and that's not possible 
> with vserver (which i can imagine, is a "problem" for some people)

obviously you didn't read my reply, because a) it _is_ possbile
and b) it is not really smart to let the guest do the firewalling :)

best,
Herbert

> grtzzzz
> 
> Rik Bobbaers
> 
> -- http://harry.enzoverder.be
> linux/unix/system/network/security/hardware/DR admin
> 
> > On Monday 10 August 2009, Michael wrote:
> >> 1. on guest runnig "fail2ban" using iptables,
> > Or run fail2ban on the host alone,  and modify your jail.conf thusly:
> >
> > logpath  = /var/log/messages
> >            /vservers/*/var/log/messages
> >
> > Cheers,
> >   Steve
> >