Re: [gentoo-user] Increasing security [WAS: Rooted/compromised Gentoo, seeking advice [Solved?]

[Jarry <mr.jarry@gmail.com>]

On 16. 8. 2010 17:29, Mark Knecht wrote:
> On Mon, Aug 16, 2010 at 7:16 AM, Bill Longman<bill.longman@gmail.com>:
>>>
>>> That is why I picked up Linux-VServer (actually, first I tried
>>> OpenVZ but could not make it run). It is a kind of compromise,
>>> where all guests share the same kernel. This brings certain
>>> security implications, but on the other side, I can run dozens
>>> of guest on a moderate machine, with 4-cores and 8GB memory
>>> (i.e. a guest running bind takes just about 20MB of memory)...
>>
>> This looks rather interesting, Jarry. Is it simply a matter of compiling
>> the vserver-sources and util-vserver? Did it take much time to set up
>> the kernel for your box? Or is it pretty much a typical kernel setup?
>> Any good tools in the util-vserver package?

vserver-sources and util-vserver was all I needed. Kernel is
pretty much like common, with ~10 additional options. util-vserver
contains handy tools, like "v*" (* being emerge, esync, kill,
limit, mount, ps, sched, etc.). Updating all gentoo-guests can be
done with one command executed in host...

>> Sounds very efficient.

Really is. Now I'm running 27 guests, mostly gentoo but also
some ubuntu and opensuse. Actually, it is possible to run any
linux-based system (as I said all systems share the same kernel).
There is also pretty good control over resources allocated
to individual guests (disk, memory, cpu).

Administration is very comfortable. Tasks like clonning,
backup/restore, moving, migration, etc, are very easy to...

> I guess the baselayout-vserver packages is somehow for setting up each
> of the guests?

Guests are installed using customised stage3 (baselayout2-based).
After that, you work with them as with normal gentoo-system.

> QUESTION: Where does X run? In the host or separate copies in each guest?

If you need X, you can create a special guest for it, and run X
there. The only thing which must run in host are kernel-modules
(i.e. nvidia driver). I tested this only as an experiment, but
it works. I've heard of someone running X+Wine in vserver-guest.
It is also possible to run X+VMware+Windows in vserver-guest...

> For a long time I've wanted to set up a single piece of hardware for
> my parents, but with two screens, two keyboards, two mice. Each user
> would have what they expect in front of them physically but it's
> really a single computer. Can that be done using this software?

Frankly, I do not know. But for each guest you can setup different
tty and IP, so maybe it would be possible. Though I think maybe
some kind of terminal server would be more suitable...

Jarry

-- 
_______________________________________________________________
This mailbox accepts e-mails only from selected mailing-lists!
Everything else is considered to be spam and therefore deleted.