On Tue, Apr 19, 2011 at 09:50:07PM +0000, cuimalo wrote: > Very well put. Special casing disabled. That led me into the real > problem: I had the host setup to use the IP addresses as well > preventing binding. > Thanks! Would you like me to wiki this? I guess it should be already covered by the FAQ, but if you feel that something is missing, please by all means go ahead and add it ... best, Herbert > On Mon, Apr 18, 2011 at 19:22, Herbert Poetzl <herbert@13thfloor.at> wrote: >> On Mon, Apr 18, 2011 at 10:31:00AM -0700, cuimalo wrote: >>> 'Automatically Assign Loopback IP' does in fact appear. >>> My loopback connections on vserver clients go to my host. >> when your 'loopback' connections end up on the host, then >> this means that the host is not properly restricted for >> that service, e.g. if you run sshd on the host, which >> binds to 0.0.0.0 (IP_ADDR_ANY) it will automatically >> intercept _any_ ssh to _any_ local address ... >> http://linux-vserver.org/Frequently_Asked_Questions >> (point 8.2) >>> How do I use the 'Remap Source IP Address' behavior? >> lback remapping will automatically map any 127.x.x.x >> address to the guest assigned lback address, which, when >> 'Automatically Assign Loopback IP' is enabled, will be >> configured to 127.x.y.1 where x.y is the context id >> also make sure that when you want loopback isolation >> that you disable the single_ip special casing if your >> guest has just a single IP (besides lback) assigned, >> but that is not related to this problem :) >>> On Mon, Apr 18, 2011 at 10:15, cuimalo <cuimalo@gmail.com> wrote: >>>> My issue is that 'Remap Source IP Address' or 'Automatically Assign >>>> Loopback IP' do not appear as options in gentoo's menuconfig. >>>> On Mon, Apr 18, 2011 at 10:03, cuimalo <cuimalo@gmail.com> wrote: >>>>> Howdy, >>>>> Help me out and I'll write it up in the wiki! >>>>> I've checked the docs (briefly) and the google for this. >>>>> I basically need local telnet. >> so to recap, don't run a telnet server on the host, or >> if you need one, restrict it to the host-only IPs >> note: the guests are automatically restricted to the >> assigned subset, so no additional actions are required >> there ... >> HTH, >> Herbert >>>>> Thanks! >>>>> (title: simple 127.0.0.1 functionality)