Tue, 26 Feb 2008 05:06:50 -0800 (PST)
----- Mensaje original ----
De: Daniel Hokka Zakrisson <daniel@hozac.com>
Para: vserver@list.linux-vserver.org
CC: Alejandro Cabrera <alejandro facultad@yahoo.com.ar>
Enviado: martes 26 de febrero de 2008, 10:20:16
Asunto: Re: [vserver] Vserver and localhost sniffing
Alejandro
Cabrera
wrote:
>
Dear
all,
I
read
that
if
I
have
a
vserver
host
with
lo
(127.0.0.1)
and
>
some
vserver
guests
with
lo
127.0.0.2,
127.0.0.3,
etc...there
is
a
>
>
risk
that
some
guest
root
can
use
some
type
of
sniffer
(cap)
and
sniff
the
>
traffic
across
127.0.0.1
that
is
ALL
localhost
traffic
(including
>
127.0.0.2,
127.0.0.3,
etc.).
This
is
a
serious
security
problem.
>
>
>
>
Here
is
my
question:
what
happen
with
localhost
sniffing
if
I
assign
a
>
private
IP
to
the
guest
localhosts
in
order
to
replace
127.0.0.2,
>
>
127.0.0.3,
etc.
with
192.168.0.2,
192.168.0.3,
etc.???
Guest
roots
can
>
still
sniff
the
traffic
???
>>root
in
a
guest
simply
cannot
sniff
traffic
at
all,
if
you
don't
give
>>him/her
too
many
capabilities.
If
you
give
the
guest
CAP NET RAW,
root
>>will
be
able
to
see
any
traffic
on
any
interface,
regardless
of
>>restrictions
placed
on
the
network
context.
Just CAP NET RAW capability ??? Or in group with CAP NET ADMIN capability ???
Thanks
--
Daniel
Hokka
Zakrisson
Yahoo! Encuentros.
Ahora encontrar pareja es mucho más fácil, probá el nuevo Yahoo! Encuentros http://yahoo.cupidovirtual.com/servlet/NewRegistration
----- Mensaje original ----
De: Daniel Hokka Zakrisson <daniel@hozac.com>
Para: vserver@list.linux-vserver.org
CC: Alejandro Cabrera <alejandro facultad@yahoo.com.ar>
Enviado: martes 26 de febrero de 2008, 10:20:16
Asunto: Re: [vserver] Vserver and localhost sniffing
Alejandro
Cabrera
wrote:
>
Dear
all,
I
read
that
if
I
have
a
vserver
host
with
lo
(127.0.0.1)
and
>
some
vserver
guests
with
lo
127.0.0.2,
127.0.0.3,
etc...there
is
a
>
>
risk
that
some
guest
root
can
use
some
type
of
sniffer
(cap)
and
sniff
the
>
traffic
across
127.0.0.1
that
is
ALL
localhost
traffic
(including
>
127.0.0.2,
127.0.0.3,
etc.).
This
is
a
serious
security
problem.
>
>
>
>
Here
is
my
question:
what
happen
with
localhost
sniffing
if
I
assign
a
>
private
IP
to
the
guest
localhosts
in
order
to
replace
127.0.0.2,
>
>
127.0.0.3,
etc.
with
192.168.0.2,
192.168.0.3,
etc.???
Guest
roots
can
>
still
sniff
the
traffic
???
>>root
in
a
guest
simply
cannot
sniff
traffic
at
all,
if
you
don't
give
>>him/her
too
many
capabilities.
If
you
give
the
guest
CAP NET RAW,
root
>>will
be
able
to
see
any
traffic
on
any
interface,
regardless
of
>>restrictions
placed
on
the
network
context.
Just CAP NET RAW capability ??? Or in group with CAP NET ADMIN capability ???
Thanks
--
Daniel
Hokka
Zakrisson
Tarjeta de crédito Yahoo! de Banco Supervielle.
Solicitá tu nueva Tarjeta de crédito. De tu PC directo a tu casa.
Visitá www.tuprimeratarjeta.com.ar