Subject: Re: [vserver] Loopback interfaces in vserver 2.2
From: "Daniel Hokka Zakrisson" <daniel@hozac.com>
Date: Sun, 17 Feb 2008 12:18:30 +0100 (CET)

Declan Mullen wrote:
> Hi
>
> I'm a newbee to vserver.
>
> I want my guest to have a secure 'localhost' definition that will
> satisfy the requirements of the guest's applications. However having
> read lots of the documentation at "linux-vserver.org" and the mailing
> list archives, I'm still very unsure as how to configure that.
>
> The host and guest are Debian Etch with the latest updates installed and
> running the pre-built kernel "2.6.18-6-vserver-k7".
> Its "/proc/virtual/info" contains:
>   VCIVersion:     0002:0002
>   VCISyscall:     273
>   VCIKernel:      03000076
> I presume "0002:0002" means that I'm running vserver stable release
> "2.2".  Please let me know if this assumption is incorrect.

No, that's 2.0.2.2-rc9.

> The version of the "util-vserver" package is "0.30.212-1".
>
> I created my guest with this command line:
> vserver jackv1  build -m debootstrap --hostname jackv1.jadplace.com
> --interface eth0:192.168.1.132/24 -- -d etch -m
> ftp://ftp.au.debian.org/debian/ -- --resolve-deps --arch i386
>
> My guest does not have a 127.0.0.1 interface, not even a unconfigured
> loopback "lo" interface. "ifconfig -a" shows only the guest's single
> "192.168.1.132" eth0 interface.

As it should, it's the only interface where the guest has IP addresses.

> The guest's primary job is to run the "scalix" application
> (www.scalix.com) and its dependencies (eg apache2, progresql, sendmail).
> The scalix doco states that "/etc/hosts" needs to contain "127.0.0.1
> localhost" (see
> http://www.scalix.com/wiki/index.php?title=Manual_Installation_Debian_Etch
> and
> http://www.scalix.com/wiki/index.php?title=Manual_Installation#Network_Configuration).
> So ideally I need my guest to have a private 127.0.0.1 interface, but I
> realise that with vserver "2.2" I might have to compromise on that.
>
> It might be possible for my guest to be configured to have access to the
> same single "127.0.0.1" loopback interface that is used by other guests
> (and the host), but I'ld be concerned about the security implications of
> that, as I don't trust the other guests.
>
> I could try to work around this issue by defining "localhost" as
> "192.168.1.132" rather than "127.0.0.1", and if the apps in the guest
> are not hard coded to access 127.0.0.1 but instead access "localhost",
> then that might work. However, I cannot be sure that the current and
> future versions of apps in the guest will be satisfied with that. And
> given that the "scalix" documentation already states that it does need
> "localhost" to resolve to "127.0.0.1", then I doubt that I'll be lucky
> enough with this workaround.

127.0.0.1 is rewritten in the kernel to the guest's first IP address
anyway. The only way the applications could find out is if they explicitly
test the socket/peer address.

> BTW, given that some apps allow more access  via localhost on the
> assumption that localhost is the internal 127.0.0.1 interface and thus
> more secure, I'm concerned that defining localhost as eth0's
> 192.168.1.132 might result in an increased security risk.
>
> Can someone please tell me what I can hope to achieve with the version
> 2.2 vserver that I'm using and can you please either tell me how to
> configure it or point me to the doco that will tell me how to configure
> it. Many thanks.
>
> I see from the vserver "Feature Matrix" that the development version 2.3
> supports a private "127.0.0.1" loopback interface for each guest (which
> is the ideal solution). Is this version stable enough to use ? When is
> the 2.4 stable version expected to be released ?

I've been running 2.3 since we merged IPv6 support, and I've had no
serious issues.

> Many thanks,
> Declan

-- 
Daniel Hokka Zakrisson