Subject: Re: [vserver] Vserver and localhost sniffing
From: Alejandro Cabrera <alejandro_facultad@yahoo.com.ar>
Date: Tue, 26 Feb 2008 05:06:50 -0800 (PST)
Tue, 26 Feb 2008 05:06:50 -0800 (PST)


----- Mensaje original ----
De: Daniel Hokka Zakrisson <daniel@hozac.com>
Para: vserver@list.linux-vserver.org
CC: Alejandro Cabrera <alejandro facultad@yahoo.com.ar>
Enviado: martes 26 de febrero de 2008, 10:20:16
Asunto: Re: [vserver] Vserver and localhost sniffing

Alejandro 
Cabrera 
wrote:
> 
Dear 
all, 
I 
read 
that 
if 
I 
have 
a 
vserver 
host 
with 
lo 
(127.0.0.1) 
and
> 
some 
vserver 
guests 
with 
lo 
127.0.0.2, 
127.0.0.3, 
etc...there 
is 
a
>
> 
risk 
that 
some 
guest 
root 
can 
use 
some 
type 
of 
sniffer 
(cap) 
and 
sniff 
the
> 
traffic 
across 
127.0.0.1 
that 
is 
ALL 
localhost 
traffic 
(including
> 
127.0.0.2, 
127.0.0.3, 
etc.). 
This 
is 
a 
serious 
security 
problem.
>
>
>
> 
Here 
is 
my 
question: 
what 
happen 
with 
localhost 
sniffing 
if 
I 
assign 
a
> 
private 
IP 
to 
the 
guest 
localhosts 
in 
order 
to 
replace 
127.0.0.2,
>
> 
127.0.0.3, 
etc. 
with 
192.168.0.2, 
192.168.0.3, 
etc.??? 
Guest 
roots 
can
> 
still 
sniff 
the 
traffic 
???

>>root 
in 
a 
guest 
simply 
cannot 
sniff 
traffic 
at 
all, 
if 
you 
don't 
give
>>him/her 
too 
many 
capabilities. 
If 
you 
give 
the 
guest 
CAP NET RAW, 
root
>>will 
be 
able 
to 
see 
 any  
traffic 
on 
 any  
interface, 
regardless 
of
>>restrictions 
placed 
on 
the 
network 
context.

Just CAP NET RAW capability ??? Or in group with CAP NET ADMIN capability ???

Thanks

-- 
Daniel 
Hokka 
Zakrisson






      Yahoo! Encuentros.

Ahora encontrar pareja es mucho más fácil, probá el nuevo Yahoo! Encuentros http://yahoo.cupidovirtual.com/servlet/NewRegistration



----- Mensaje original ----
De: Daniel Hokka Zakrisson <daniel@hozac.com>
Para: vserver@list.linux-vserver.org
CC: Alejandro Cabrera <alejandro facultad@yahoo.com.ar>
Enviado: martes 26 de febrero de 2008, 10:20:16
Asunto: Re: [vserver] Vserver and localhost sniffing

Alejandro Cabrera wrote:
> Dear all, I read that if I have a vserver host with lo (127.0.0.1) and
> some vserver guests with lo 127.0.0.2, 127.0.0.3, etc...there is a
>
> risk that some guest root can use some type of sniffer (cap) and sniff the
> traffic across 127.0.0.1 that is ALL localhost traffic (including
> 127.0.0.2, 127.0.0.3, etc.). This is a serious security problem.
>
>
>
> Here is my question: what happen with localhost sniffing if I assign a
> private IP to the guest localhosts in order to replace 127.0.0.2,
>
> 127.0.0.3, etc. with 192.168.0.2, 192.168.0.3, etc.??? Guest roots can
> still sniff the traffic ???

>>root in a guest simply cannot sniff traffic at all, if you don't give
>>him/her too many capabilities. If you give the guest CAP NET RAW, root
>>will be able to see any traffic on any interface, regardless of
>>restrictions placed on the network context.

Just CAP NET RAW capability ??? Or in group with CAP NET ADMIN capability ???

Thanks

--
Daniel Hokka Zakrisson




Tarjeta de crédito Yahoo! de Banco Supervielle. Solicitá tu nueva Tarjeta de crédito. De tu PC directo a tu casa.
Visitá www.tuprimeratarjeta.com.ar