http://linux-vserver.org/api.php?action=feedcontributions&user=JacobAnawalt&feedformat=atomLinux-VServer - User contributions [en]2024-03-29T14:46:09ZUser contributionsMediaWiki 1.20.2http://linux-vserver.org/Talk:Problematic_ProgramsTalk:Problematic Programs2008-10-18T02:22:01Z<p>JacobAnawalt: </p>
<hr />
<div>I stronly suggest we rename this page to something else. I have become embroiled in a discussion with a customer and their development team who do not fully understand the concept of vservers, and the management team is not strong enough to discern quality of all technical arguments. The developer is using the title of this particular page as an indication that there are "problems with vservers and we shouldnt use them".<br />
<br />
The first line of the page does outline how its most often not vserver's fault, but the name of the page seems to summarize a point of view about vservers thats detrimental.<br />
<br />
Perhaps we should rename it to soemthing like "programs needing vserver-specific configuration" or the like. Hard to find a nice two word one like "problematic programs", but the name suggests more negative aspects than it should.<br />
<br />
-- [[User:Math|Math]]<br />
: The way that I see it, "Problematic Programs" means that the ''programs'' are problematic, not Linux-VServer itself ;). A new title would still be good, but "Programs needing VServer-specific configuration" is probably too long for a page title. <br /> -- [[User:Daniel15|<span style="color: darkblue; font-weight: bold; border: 1px solid #6666FF; padding: 3px;">Daniel15</span>]] <big>(</big><sup>[[User talk:Daniel15|Talk]]</sup>/<sub>[[Special:Contributions/Daniel15|Contribs]]</sub><big>)</big> 09:30, 4 February 2007 (CET)<br />
<br />
How about "Issues with 3rd party software"?<br />
--[[User:KornAndras|Guy-]] 22:13, 4 February 2007 (CET)<br />
<br />
== 127.0.0.1 issues ==<br />
<br />
I have suggested on the FAQ page that ''How do i install nagios-plugins on a Gentoo guest?'' be merged into this topic. During my irc conversations with Bertl today he said he would rather see these suggestions removed altogether.<br />
<br />
At the least I would like to update this topic some more to give people more understanding on the topic. Perhaps a full page ought to be created and dedicated to giving the scoop on using localhost and on the loopback interface in general and in vserver. That way more right information is presented than wrong information. Some notes for that potential page, or for those who want to know what is being discussed about this topic:<br />
<br />
* Most apps have worked fine with all versions of vserver. If the app looked up the 'loopback' address interface via the localhost name, they always worked because by default the vserver tools would configure that to be the same as your first configured ip address.<br />
<br />
* Some apps are hard-coded to use 127.0.0.1 instead of resolving localhost. These programs had problems under versions of vserver before 2.3 unless you exposed 127.0.0.1 to the guest. This action would have security implications and run time problems you may not have forseen, such as having two guests both try to bind their http server to 127.0.0.1:80 via their 0.0.0.0:80 binding.<br />
<br />
* With the 2.3.x vserver kernel patch forward and back mapping of 127 address was available. You can set this via the nflags LBACK_REMAP capability. It is probably enabled on by default on your system. This presents to each guest the 127.0.0.1 address without you adding an interface. It virtualizes the interface into 127.x.y.1 where x.y are derived from your security context so the 127.0.0.1 traffic your guest deals with is separate from another guest. If you ''wish'' to allow all hosts to share the 127 network to communicate, that is also an option in 2.3.x by removing the LBACK_REMAP flag and adding the LBACK_ALLOW flag. At that point you can start running into the 0.0.0.0:x issue and may want to configure your own 127.x.y.1 scheme.</div>JacobAnawalthttp://linux-vserver.org/Talk:Problematic_ProgramsTalk:Problematic Programs2008-10-18T02:20:22Z<p>JacobAnawalt: 127.0.0.1 issues</p>
<hr />
<div>I stronly suggest we rename this page to something else. I have become embroiled in a discussion with a customer and their development team who do not fully understand the concept of vservers, and the management team is not strong enough to discern quality of all technical arguments. The developer is using the title of this particular page as an indication that there are "problems with vservers and we shouldnt use them".<br />
<br />
The first line of the page does outline how its most often not vserver's fault, but the name of the page seems to summarize a point of view about vservers thats detrimental.<br />
<br />
Perhaps we should rename it to soemthing like "programs needing vserver-specific configuration" or the like. Hard to find a nice two word one like "problematic programs", but the name suggests more negative aspects than it should.<br />
<br />
-- [[User:Math|Math]]<br />
: The way that I see it, "Problematic Programs" means that the ''programs'' are problematic, not Linux-VServer itself ;). A new title would still be good, but "Programs needing VServer-specific configuration" is probably too long for a page title. <br /> -- [[User:Daniel15|<span style="color: darkblue; font-weight: bold; border: 1px solid #6666FF; padding: 3px;">Daniel15</span>]] <big>(</big><sup>[[User talk:Daniel15|Talk]]</sup>/<sub>[[Special:Contributions/Daniel15|Contribs]]</sub><big>)</big> 09:30, 4 February 2007 (CET)<br />
<br />
How about "Issues with 3rd party software"?<br />
--[[User:KornAndras|Guy-]] 22:13, 4 February 2007 (CET)<br />
<br />
== 127.0.0.1 issues ==<br />
<br />
I have suggested on the FAQ page that ''How do i install nagios-plugins on a Gentoo guest?'' be merged into this topic. During my irc conversations with Bertl today he said he would rather see these suggestions removed altogether.<br />
<br />
At the least I would like to update this topic some more to give people more understanding on the topic. Perhaps a full page ought to be created and dedicated to giving the scoop on using localhost and on the loopback interface in general and in vserver. That way more right information is presented than wrong information. Some notes for that potential page, or for those who want to know what is being discussed about this topic:<br />
<br />
* Most apps have worked fine with all versions of vserver. If the app looked up the 'loopback' address interface via the localhost name, they always worked because by default the vserver tools would configure that to be the same as your first configured ip address.<br />
<br />
* Some apps are hard-coded to use 127.0.0.1 instead of resolving localhost. These programs had problems under versions of vserver before 2.3 unless you exposed 127.0.0.1 to the guest. This action would have security implications and run time problems you may not have forseen, such as having two guests both try to bind their http server to 128.0.0.1:80 via their 0.0.0.0:80 binding.<br />
<br />
* With the 2.3.x vserver kernel patch forward and back mapping of 127 address was available. You can set this via the nflags LBACK_REMAP capability. It is probably enabled on by default on your system. This presents to each guest the 127.0.0.1 address without you adding an interface. It virtualizes the interface into 127.x.y.1 where x.y are derived from your security context so the 127.0.0.1 traffic your guest deals with is separate from another guest. If you ''wish'' to allow all hosts to share the 127 network to communicate, that is also an option in 2.3.x by removing the LBACK_REMAP flag and adding the LBACK_ALLOW flag. At that point you can start running into the 0.0.0.0:x issue and may want to configure your own 127.x.y.1 scheme.</div>JacobAnawalthttp://linux-vserver.org/Talk:Frequently_Asked_QuestionsTalk:Frequently Asked Questions2008-10-18T01:59:38Z<p>JacobAnawalt: Argument for moving nagios-plugins on Gentoo to Problamatic Programs</p>
<hr />
<div>"great flower page"? Wasn't that the one at http://www.nongnu.org/util-vserver/doc/conf/configuration.html? Looks like it's been... "fixed" now :D --[[User:Daniel15|<span style="color: darkblue; font-weight: bold;">Daniel15</span>]] <big>(</big><sup>[[User talk:Daniel15|Talk]]</sup>/<sub>[[Special:Contributions/Daniel15|Contribs]]</sub><big>)</big> 12:42, 24 January 2007 (CET)<br />
<br />
== VPNC problem with tun ==<br />
<br />
Dear Vserver users,<br />
<br />
I know some explanation was given about the TUN device on a vserver with openvpn<br />
<br />
I'm trying to get vpnc to work on a virtual server.<br />
I can't use openvpn because I need to connect to a Cisco PIX that only understands IPSEC.<br />
<br />
I've created /dev/net/tun with <br />
apt-get install uml-utilities<br />
# cd /var/lib/vserver/<myopenvpnserver>/dev/<br />
# ./MAKEDEV tun<br />
as suggested. I don't use a tap interface<br />
<br />
my vpnc.conf is<br />
IPSec gateway x.x.x.x<br />
IPSec ID somename<br />
IPSec secret somepass<br />
Xauth username some username<br />
Xauth password some pass<br />
<br />
Now when i try to do vpnc-connect on my vserver, I get :<br />
vpnc: can't initialise tunnel interface: Operation not permitted<br />
<br />
chown 777 /dev/net/tun doesn't help<br />
<br />
Please help me out here<br />
<br />
== About memory limits for a guest ==<br />
<br />
Since RSS is used to limit the memory resource for a guest. If processes in a guest use share libraries (libssl.so, libpam.so, etc...), are the shared parts of RSS in every process counted as the memory usage?<br />
In this situation, if I set the RSS hard limits to 256M, in fact the guest can not use up to a 256M real physical memory, maybe much less than 256M. Because some shared part are counted as privately used. Is that true?<br />
<br />
== How do i install nagios-plugins on a Gentoo guest? ==<br />
<br />
This seems to be another play on the Problamatic_Programs 127.0.0.1 issue. If it is not a FAQ, I suggest that this is not either but instead be merged with the other onto Problamatic Programs.<br />
<br />
Perhaps there should be a FAQ starting point entry for localhost / loopback issues pointing to a full page. I know I took up a lot of Bertl and other's time on IRC today due to a backlog of confusion in my mind about it which had lead to a configuration that was tricky to troubleshoot.</div>JacobAnawalt