Subject: Re: [vserver] Networking questions
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Wed, 23 Jun 2010 14:56:12 +0200

On Wed, Jun 23, 2010 at 01:13:54AM -0700, Siv wrote:
> Thanks. Some behaviors I noticed :
> 
> 1. I can ssh into the host providing the ip address 
>    of the guest i.e ssh root@guest gets me into the host. 

this is expected, as with IP isolation, the (almighty) host
can bind any IP, thus without restriction, sshd on the host
will bind all IPs and so answer to all connects.

This is covered on the wiki, specifically in the FAQ section.

>    I hope this is not by design.

This is by design.

> 2. I have two guests and while running "ifconfig" from host, 
>    shows the ip address of only one guest. 
>    The other guest's info is missing.

ifconfig is more than a decade old and was 'replaced' by 'ip'
from iproute2 several years ago, but if you really want to
manage your networking with ifconfig, you can utilize aliases
which are also seen by ifconfig

> Am running 2.6.32.13-vs2.3.0.36.29.4

good choice ...

best,
Herbert

> --Siv
> 
> On Tue, Jun 22, 2010 at 6:27 PM, Mark Little <marklittle@koallo.com> wrote:
> 
> >  On 22/06/2010 7:27 PM, Herbert Poetzl wrote:
> >
> >> On Mon, Jun 21, 2010 at 10:35:36PM -0700, Siv wrote:
> >>
> >>> My requirement is to allow different routing table for the
> >>> guest and host.
> >>> Is that possible?
> >>>
> >> yes, if you want performance, use multiple routing tables
> >> and select them based on the source IP, if you don't care
> >> about performance, check out the network namespaces, they
> >> will allow you to have 'virtual' network spaces
> >>
> >>  Please let me know,
> >>>
> >> best,
> >> Herbert
> >>
> >
> > Hi Herbert,
> >
> > On a related note - I was wondering if you could let me know if what I am
> > seeing is normal or I have broken my vserver config somehow..
> >
> > Kernel: 2.6.31.13-vs2.3.0.36.28.2-beng
> > VS-API: 0x00020305
> > util-vserver: 0.30.216-pre2883; Apr 28 2010, 15:36:17
> >
> > I currently utilize source routing using the iproute2 system, however I was
> > wondering if its normal for the guests to be able able to see all the rules
> > and routes even if they do not apply to them.
> >
> > 'ip addr ls' only shows the assigned interfaces, however 'ip route ls'
> > shows extra routes which give away the source IP.
> >
> > eg:
> >
> > [gizmo1:~]# ip addr ls
> > 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
> >    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
> >    inet 127.0.0.1/8 scope host lo
> > 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state
> > UP qlen 1000
> >    link/ether 00:0d:60:9c:37:82 brd ff:ff:ff:ff:ff:ff
> >    inet 10.1.1.20/24 brd 10.1.1.255 scope global secondary eth0
> >    inet xxx.xxx.194.119/27 brd xxx.xxx.194.127 scope global secondary eth0
> >
> > [gizmo1:~]# ip route ls
> > xxx.xxx.194.96/27 dev eth0  proto kernel  scope link  src xxx.xxx.194.113
> > xxx.xxx.201.128/25 dev eth0  proto kernel  scope link  src xxx.xxx.201.162
> > xxx.xxx.219.0/24 dev eth0  proto kernel  scope link  src xxx.xxx.219.34
> > xxx.xxx.194.0/24 dev eth0  proto kernel  scope link  src xxx.xxx.194.118
> > 10.1.1.0/24 dev eth0  proto kernel  scope link  src 10.1.1.36
> > default via xxx.xxx.194.97 dev eth0  src xxx.xxx.194.113
> >
> > [gizmo1:~]# ip rule ls
> > 0:      from all lookup local
> > 9999:   from 10.1.1.0/24 to xxx.xxx.194.0/24 lookup 203
> > 20000:  from xxx.xxx.194.118 lookup 204
> > 20000:  from xxx.xxx.194.119 lookup 205
> > 20000:  from xxx.xxx.194.125 lookup 210
> > 20000:  from xxx.xxx.201.162 lookup 210
> > 20000:  from xxx.xxx.219.34 lookup 210
> > 20000:  from xxx.xxx.219.202 lookup 210
> > 32766:  from all lookup main
> > 32767:  from all lookup default
> > [root@gizmo1:~]#
> >
> > It's not a huge issue for us at the moment as most of the our vserver
> > guests are internal servers - however we were looking at offering it as a
> > service, which means now I have to worry more about security.
> >
> > I will look into the network namespaces as that may be the safest option
> > for those specific servers, but I just wanted to make sure I haven't done
> > something wrong along the way which is allowing this information to be
> > shown.
> >
> >
> > Regards,
> > Mark
> >
> >
> >
> >
> >