Subject: Re: [vserver] Re: simple 127.0.0.1 functionality
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Mon, 18 Apr 2011 21:22:13 +0200

On Mon, Apr 18, 2011 at 10:31:00AM -0700, cuimalo wrote:
> 'Automatically Assign Loopback IP' does in fact appear. 
> My loopback connections on vserver clients go to my host. 

when your 'loopback' connections end up on the host, then
this means that the host is not properly restricted for
that service, e.g. if you run sshd on the host, which
binds to 0.0.0.0 (IP_ADDR_ANY) it will automatically
intercept _any_ ssh to _any_ local address ...

http://linux-vserver.org/Frequently_Asked_Questions
(point 8.2)

> How do I use the  'Remap Source IP Address' behavior?

lback remapping will automatically map any 127.x.x.x
address to the guest assigned lback address, which, when
'Automatically Assign Loopback IP' is enabled, will be
configured to 127.x.y.1 where x.y is the context id

also make sure that when you want loopback isolation
that you disable the single_ip special casing if your
guest has just a single IP (besides lback) assigned,
but that is not related to this problem :)

> On Mon, Apr 18, 2011 at 10:15, cuimalo <cuimalo@gmail.com> wrote:
>> My issue is that 'Remap Source IP Address' or 'Automatically Assign
>> Loopback IP' do not appear as options in gentoo's menuconfig.

>> On Mon, Apr 18, 2011 at 10:03, cuimalo <cuimalo@gmail.com> wrote:
>>> Howdy,

>>> Help me out and I'll write it up in the wiki! 
>>> I've checked the docs (briefly) and the google for this. 
>>> I basically need local telnet.

so to recap, don't run a telnet server on the host, or
if you need one, restrict it to the host-only IPs
note: the guests are automatically restricted to the
assigned subset, so no additional actions are required
there ...

HTH,
Herbert

>>> Thanks!


>>> (title: simple 127.0.0.1 functionality)