Subject: Loopback interfaces in vserver 2.2
From: Declan Mullen <declan@jadplace.com>
Date: Sun, 17 Feb 2008 20:21:30 +1100

Hi

I'm a newbee to vserver.

I want my guest to have a secure 'localhost' definition that will 
satisfy the requirements of the guest's applications. However having 
read lots of the documentation at "linux-vserver.org" and the mailing 
list archives, I'm still very unsure as how to configure that.

The host and guest are Debian Etch with the latest updates installed and 
running the pre-built kernel "2.6.18-6-vserver-k7".
Its "/proc/virtual/info" contains:
  VCIVersion:     0002:0002
  VCISyscall:     273
  VCIKernel:      03000076
I presume "0002:0002" means that I'm running vserver stable release 
"2.2".  Please let me know if this assumption is incorrect.

The version of the "util-vserver" package is "0.30.212-1".

I created my guest with this command line:
vserver jackv1  build -m debootstrap --hostname jackv1.jadplace.com 
--interface eth0:192.168.1.132/24 -- -d etch -m 
ftp://ftp.au.debian.org/debian/ -- --resolve-deps --arch i386

My guest does not have a 127.0.0.1 interface, not even a unconfigured 
loopback "lo" interface. "ifconfig -a" shows only the guest's single 
"192.168.1.132" eth0 interface.

The guest's primary job is to run the "scalix" application 
(www.scalix.com) and its dependencies (eg apache2, progresql, sendmail). 
The scalix doco states that "/etc/hosts" needs to contain "127.0.0.1  
localhost" (see 
http://www.scalix.com/wiki/index.php?title=Manual_Installation_Debian_Etch 
and 
http://www.scalix.com/wiki/index.php?title=Manual_Installation#Network_Configuration).

So ideally I need my guest to have a private 127.0.0.1 interface, but I 
realise that with vserver "2.2" I might have to compromise on that.

It might be possible for my guest to be configured to have access to the 
same single "127.0.0.1" loopback interface that is used by other guests 
(and the host), but I'ld be concerned about the security implications of 
that, as I don't trust the other guests.

I could try to work around this issue by defining "localhost" as 
"192.168.1.132" rather than "127.0.0.1", and if the apps in the guest 
are not hard coded to access 127.0.0.1 but instead access "localhost", 
then that might work. However, I cannot be sure that the current and 
future versions of apps in the guest will be satisfied with that. And 
given that the "scalix" documentation already states that it does need 
"localhost" to resolve to "127.0.0.1", then I doubt that I'll be lucky 
enough with this workaround.

BTW, given that some apps allow more access  via localhost on the 
assumption that localhost is the internal 127.0.0.1 interface and thus 
more secure, I'm concerned that defining localhost as eth0's 
192.168.1.132 might result in an increased security risk.

Can someone please tell me what I can hope to achieve with the version 
2.2 vserver that I'm using and can you please either tell me how to 
configure it or point me to the doco that will tell me how to configure 
it. Many thanks.

I see from the vserver "Feature Matrix" that the development version 2.3 
supports a private "127.0.0.1" loopback interface for each guest (which 
is the ideal solution). Is this version stable enough to use ? When is 
the 2.4 stable version expected to be released ?

Many thanks,
Declan