Subject: Re: [vserver] Loopback interfaces in vserver 2.2
From: Declan Mullen <declan@jadplace.com>
Date: Sun, 17 Feb 2008 22:54:13 +1100

Daniel Hokka Zakrisson wrote:
Declan Mullen wrote:
  
Hi

I'm a newbee to vserver.

I want my guest to have a secure 'localhost' definition that will
satisfy the requirements of the guest's applications. However having
read lots of the documentation at "linux-vserver.org" and the mailing
list archives, I'm still very unsure as how to configure that.

The host and guest are Debian Etch with the latest updates installed and
running the pre-built kernel "2.6.18-6-vserver-k7".
Its "/proc/virtual/info" contains:
  VCIVersion:     0002:0002
  VCISyscall:     273
  VCIKernel:      03000076
I presume "0002:0002" means that I'm running vserver stable release
"2.2".  Please let me know if this assumption is incorrect.
    

No, that's 2.0.2.2-rc9.
  

Thanks for correcting that. Were you able to deduce "2.0.2.2-rc9" just from the contents of "/proc/virtual/info" ? If so, how is the contents interpreted into "2.0.2.2" ? If not, what else did you consult ?

The version of the "util-vserver" package is "0.30.212-1".

I created my guest with this command line:
vserver jackv1  build -m debootstrap --hostname jackv1.jadplace.com
--interface eth0:192.168.1.132/24 -- -d etch -m
ftp://ftp.au.debian.org/debian/ -- --resolve-deps --arch i386

My guest does not have a 127.0.0.1 interface, not even a unconfigured
loopback "lo" interface. "ifconfig -a" shows only the guest's single
"192.168.1.132" eth0 interface.
    

As it should, it's the only interface where the guest has IP addresses.

  
The guest's primary job is to run the "scalix" application
(www.scalix.com) and its dependencies (eg apache2, progresql, sendmail).
The scalix doco states that "/etc/hosts" needs to contain "127.0.0.1
localhost" (see
http://www.scalix.com/wiki/index.php?title=Manual_Installation_Debian_Etch
and
http://www.scalix.com/wiki/index.php?title=Manual_Installation#Network_Configuration).
So ideally I need my guest to have a private 127.0.0.1 interface, but I
realise that with vserver "2.2" I might have to compromise on that.

It might be possible for my guest to be configured to have access to the
same single "127.0.0.1" loopback interface that is used by other guests
(and the host), but I'ld be concerned about the security implications of
that, as I don't trust the other guests.

I could try to work around this issue by defining "localhost" as
"192.168.1.132" rather than "127.0.0.1", and if the apps in the guest
are not hard coded to access 127.0.0.1 but instead access "localhost",
then that might work. However, I cannot be sure that the current and
future versions of apps in the guest will be satisfied with that. And
given that the "scalix" documentation already states that it does need
"localhost" to resolve to "127.0.0.1", then I doubt that I'll be lucky
enough with this workaround.
    

127.0.0.1 is rewritten in the kernel to the guest's first IP address
anyway. 

How would I create a 127.0.0.1 interface for my guest that "is rewritten in the kernel to the guest's first IP address" ? or if its documented somewhere can you point me to it, thanks.

The only way the applications could find out is if they explicitly
test the socket/peer address.

  
BTW, given that some apps allow more access  via localhost on the
assumption that localhost is the internal 127.0.0.1 interface and thus
more secure, I'm concerned that defining localhost as eth0's
192.168.1.132 might result in an increased security risk.

Can someone please tell me what I can hope to achieve with the version
2.2 vserver that I'm using and can you please either tell me how to
configure it or point me to the doco that will tell me how to configure
it. Many thanks.

I see from the vserver "Feature Matrix" that the development version 2.3
supports a private "127.0.0.1" loopback interface for each guest (which
is the ideal solution). Is this version stable enough to use ? When is
the 2.4 stable version expected to be released ?
    

I've been running 2.3 since we merged IPv6 support, and I've had no
serious issues.

  
Many thanks,
Declan