Subject: Re: [vserver] Re: simple 127.0.0.1 functionality
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Wed, 20 Apr 2011 01:53:27 +0200

On Tue, Apr 19, 2011 at 09:50:07PM +0000, cuimalo wrote:
> Very well put. Special casing disabled. That led me into the real
> problem: I had the host setup to use the IP addresses as well
> preventing binding.

> Thanks! Would you like me to wiki this?

I guess it should be already covered by the FAQ, but if
you feel that something is missing, please by all means
go ahead and add it ...

best,
Herbert

> On Mon, Apr 18, 2011 at 19:22, Herbert Poetzl <herbert@13thfloor.at> wrote:
>> On Mon, Apr 18, 2011 at 10:31:00AM -0700, cuimalo wrote:
>>> 'Automatically Assign Loopback IP' does in fact appear.
>>> My loopback connections on vserver clients go to my host.

>> when your 'loopback' connections end up on the host, then
>> this means that the host is not properly restricted for
>> that service, e.g. if you run sshd on the host, which
>> binds to 0.0.0.0 (IP_ADDR_ANY) it will automatically
>> intercept _any_ ssh to _any_ local address ...

>> http://linux-vserver.org/Frequently_Asked_Questions
>> (point 8.2)

>>> How do I use the  'Remap Source IP Address' behavior?

>> lback remapping will automatically map any 127.x.x.x
>> address to the guest assigned lback address, which, when
>> 'Automatically Assign Loopback IP' is enabled, will be
>> configured to 127.x.y.1 where x.y is the context id

>> also make sure that when you want loopback isolation
>> that you disable the single_ip special casing if your
>> guest has just a single IP (besides lback) assigned,
>> but that is not related to this problem :)

>>> On Mon, Apr 18, 2011 at 10:15, cuimalo <cuimalo@gmail.com> wrote:
>>>> My issue is that 'Remap Source IP Address' or 'Automatically Assign
>>>> Loopback IP' do not appear as options in gentoo's menuconfig.

>>>> On Mon, Apr 18, 2011 at 10:03, cuimalo <cuimalo@gmail.com> wrote:
>>>>> Howdy,

>>>>> Help me out and I'll write it up in the wiki!
>>>>> I've checked the docs (briefly) and the google for this.
>>>>> I basically need local telnet.

>> so to recap, don't run a telnet server on the host, or
>> if you need one, restrict it to the host-only IPs
>> note: the guests are automatically restricted to the
>> assigned subset, so no additional actions are required
>> there ...

>> HTH,
>> Herbert

>>>>> Thanks!


>>>>> (title: simple 127.0.0.1 functionality)