0081.html: Difference between revisions
(Restored content from Wayback Machine) |
(Restored content from Wayback Machine) Tag: Manual revert |
||
| Line 1: | Line 1: | ||
<div class="links"> | <div class="links"> | ||
'''[ | '''[Vserver] Vserver and Security:'''<br /> | ||
<span class="small">vserver development mailing list</span> <br /> | <span class="small">vserver development mailing list</span> <br /> | ||
[<nowiki/>[[../|Next/Previous Months]]] [<nowiki/>[http://www.solucorp.qc.ca/miscprj/s_context.hc Main vserver Project Homepage]] [<nowiki/>[http://www.solucorp.qc.ca/mlist/index.hc?list=vserver Howto Subscribe/Unsubscribe]] [<nowiki/>[http://www.paul.sladen.org/vserver/ Paul Sladen's vserver stuff]] | [<nowiki/>[[../|Next/Previous Months]]] [<nowiki/>[http://www.solucorp.qc.ca/miscprj/s_context.hc Main vserver Project Homepage]] [<nowiki/>[http://www.solucorp.qc.ca/mlist/index.hc?list=vserver Howto Subscribe/Unsubscribe]] [<nowiki/>[http://www.paul.sladen.org/vserver/ Paul Sladen's vserver stuff]] | ||
</div> | </div> | ||
<div class=" | <div align="center"> | ||
{| class="wikitable" border="2" width="100%" | |||
|- | |||
! [[../|About this list]] | |||
! [[date.html|Date view]] | |||
! [[index.html|Thread view]] | |||
! [[subject.html|Subject view]] | |||
! [[author.html|Author view]] | |||
! [[attachment.html|Attachment view]] | |||
|} | |||
</div> | |||
'''From:''' Herbert Poetzl ([mailto:herbert_at_13thfloor.at?Subject=Re:%20%5BVserver%5D%20Vserver%20and%20Security ''herbert_at_13thfloor.at''])<br /> | |||
'''Date:''' Thu 08 Jan 2004 - 19:12:45 GMT | |||
* '''Previous message:''' [[0080.html|Herbert Poetzl: "Re: [Vserver] 1.3.1: save_s_context: fork: Resource temporarily unavailable [was: Re: 1.3.1 with quota/limit patches]"]] | |||
* '''Next in thread:''' [[0083.html|Frank Matthieß: "Kernel capabilties (Was: [Vserver] Vserver and Security)"]] | |||
* '''Reply:''' [[0083.html|Frank Matthieß: "Kernel capabilties (Was: [Vserver] Vserver and Security)"]] | |||
* '''Reply:''' [[0087.html|Gregory (Grisha) Trubetskoy: "Re: [Vserver] Vserver and Security"]] | |||
----- | |||
Hi Community!<br /> | |||
recently (end of december last year) somebody posted<br /> | |||
a mystic message to one of the german webhosting lists<br /> | |||
stating, that vserver is insecure, and that he would<br /> | |||
suggest not to use it (no details where given) ...<br /> | |||
it 'seems' that the poster was worried about the<br /> | |||
ability to sniff network packets from other vservers<br /> | |||
on the same host, when inside a vserver.<br /> | |||
I would like to take this opportunity, to name some<br /> | |||
'real' security issues, and what you can/should do to<br /> | |||
avoid them ...<br /> | |||
first linux-vserver is based on the linux capability<br /> | |||
system and the protection this system adds to a<br /> | |||
unpatches linux kernel, as well as to a linux-vserver<br /> | |||
kernel. those capabilities allow the administrator of<br /> | |||
a linux system (or vserver host) to limit the actions<br /> | |||
even root can take. vserver tools 'automatically'<br /> | |||
reduce the set of capabilities to a sane number.<br /> | |||
CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,<br /> | |||
CAP_FOWNER, CAP_FSETID, CAP_KILL, CAP_SETGID,<br /> | |||
CAP_SETUID, CAP_NET_BIND_SERVICE, CAP_SYS_CHROOT,<br /> | |||
CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG, CAP_LEASE<br /> | |||
this does not contain the folowing capabilities for<br /> | |||
security reasons (giving any of them lowers the<br /> | |||
security of your vserver host, and makes the system<br /> | |||
vulnerable)<br /> | |||
CAP_SETPCAP<br /> | |||
transfering permitted capabilities<br /> | |||
CAP_LINUX_IMMUTABLE<br /> | |||
modifying immutable and iunlink flags<br /> | |||
CAP_NET_BROADCAST<br /> | |||
allow network broadcasting/multicasting<br /> | |||
CAP_NET_ADMIN<br /> | |||
network interface configuration<br /> | |||
setting promiscuous mode (sniffing)<br /> | |||
multicasting and routing tables<br /> | |||
CAP_NET_RAW<br /> | |||
use of raw and packet sockets<br /> | |||
CAP_IPC_LOCK, CAP_IPC_OWNER<br /> | |||
ipc owner check and mlock<br /> | |||
CAP_SYS_MODULE<br /> | |||
insert and removal of kernel modules<br /> | |||
CAP_SYS_RAWIO<br /> | |||
ioperm/iopl access and usb messages<br /> | |||
CAP_SYS_PACCT<br /> | |||
process accounting<br /> | |||
CAP_SYS_ADMIN<br /> | |||
this list would be too long, it basically<br /> | |||
alows to do everything else, not mentioned<br /> | |||
in another capability.<br /> | |||
CAP_SYS_BOOT<br /> | |||
allow reboot/halt<br /> | |||
CAP_SYS_NICE<br /> | |||
allow raising priorities, and scheduler stuff<br /> | |||
CAP_SYS_RESOURCE<br /> | |||
override resource limits<br /> | |||
override quota and reserved space<br /> | |||
modify data journaling, colsoles, keymap<br /> | |||
</ | CAP_SYS_TIME<br /> | ||
< | manipulation of the system clock<br /> | ||
CAP_MKNOD<br /> | |||
creation of kernel nodes<br /> | |||
best,<br /> | |||
Herbert<br /> | |||
_______________________________________________<br /> | |||
Vserver mailing list<br /> | |||
[mailto:Vserver_at_list.linux-vserver.org?Subject=Re:%20%5BVserver%5D%20Vserver%20and%20Security Vserver_at_list.linux-vserver.org]<br /> | |||
http://list.linux-vserver.org/mailman/listinfo/vserver<br /> | |||
----- | |||
* '''Previous message:''' [[0080.html|Herbert Poetzl: "Re: [Vserver] 1.3.1: save_s_context: fork: Resource temporarily unavailable [was: Re: 1.3.1 with quota/limit patches]"]] | |||
* '''Next in thread:''' [[0083.html|Frank Matthieß: "Kernel capabilties (Was: [Vserver] Vserver and Security)"]] | |||
* '''Reply:''' [[0083.html|Frank Matthieß: "Kernel capabilties (Was: [Vserver] Vserver and Security)"]] | |||
* '''Reply:''' [[0087.html|Gregory (Grisha) Trubetskoy: "Re: [Vserver] Vserver and Security"]] | |||
<div align="center"> | |||
{| class="wikitable" border="2" width="100%" | |||
|- | |||
! [[../|About this list]] | |||
! [[date.html|Date view]] | |||
! [[index.html|Thread view]] | |||
! [[subject.html|Subject view]] | |||
! [[author.html|Author view]] | |||
! [[attachment.html|Attachment view]] | |||
|} | |||
| Line 60: | Line 172: | ||
[<nowiki/>[[../|Next/Previous Months]]] [<nowiki/>[http://www.solucorp.qc.ca/miscprj/s_context.hc Main vserver Project Homepage]] [<nowiki/>[http://www.solucorp.qc.ca/mlist/index.hc?list=vserver Howto Subscribe/Unsubscribe]] [<nowiki/>[http://www.paul.sladen.org/vserver/ Paul Sladen's vserver stuff]]<br /> | [<nowiki/>[[../|Next/Previous Months]]] [<nowiki/>[http://www.solucorp.qc.ca/miscprj/s_context.hc Main vserver Project Homepage]] [<nowiki/>[http://www.solucorp.qc.ca/mlist/index.hc?list=vserver Howto Subscribe/Unsubscribe]] [<nowiki/>[http://www.paul.sladen.org/vserver/ Paul Sladen's vserver stuff]]<br /> | ||
<span class="small">Generated on Thu | <span class="small">Generated on Thu 08 Jan 2004 - 19:13:36 GMT by [http://www.hypermail.org/ hypermail 2.1.3]</span> | ||
</div> | </div> | ||
Revision as of 01:58, 11 November 2025
[Vserver] Vserver and Security:
vserver development mailing list
[[[../|Next/Previous Months]]] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
| [[../|About this list]] | Date view | Thread view | Subject view | Author view | Attachment view |
|---|
From: Herbert Poetzl (herbert_at_13thfloor.at)
Date: Thu 08 Jan 2004 - 19:12:45 GMT
- Previous message: Herbert Poetzl: "Re: [Vserver] 1.3.1: save_s_context: fork: Resource temporarily unavailable [was: Re: 1.3.1 with quota/limit patches]"
- Next in thread: Frank Matthieß: "Kernel capabilties (Was: [Vserver] Vserver and Security)"
- Reply: Frank Matthieß: "Kernel capabilties (Was: [Vserver] Vserver and Security)"
- Reply: Gregory (Grisha) Trubetskoy: "Re: [Vserver] Vserver and Security"
Hi Community!
recently (end of december last year) somebody posted
a mystic message to one of the german webhosting lists
stating, that vserver is insecure, and that he would
suggest not to use it (no details where given) ...
it 'seems' that the poster was worried about the
ability to sniff network packets from other vservers
on the same host, when inside a vserver.
I would like to take this opportunity, to name some
'real' security issues, and what you can/should do to
avoid them ...
first linux-vserver is based on the linux capability
system and the protection this system adds to a
unpatches linux kernel, as well as to a linux-vserver
kernel. those capabilities allow the administrator of
a linux system (or vserver host) to limit the actions
even root can take. vserver tools 'automatically'
reduce the set of capabilities to a sane number.
CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,
CAP_FOWNER, CAP_FSETID, CAP_KILL, CAP_SETGID,
CAP_SETUID, CAP_NET_BIND_SERVICE, CAP_SYS_CHROOT,
CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG, CAP_LEASE
this does not contain the folowing capabilities for
security reasons (giving any of them lowers the
security of your vserver host, and makes the system
vulnerable)
CAP_SETPCAP
transfering permitted capabilities
CAP_LINUX_IMMUTABLE
modifying immutable and iunlink flags
CAP_NET_BROADCAST
allow network broadcasting/multicasting
CAP_NET_ADMIN
network interface configuration
setting promiscuous mode (sniffing)
multicasting and routing tables
CAP_NET_RAW
use of raw and packet sockets
CAP_IPC_LOCK, CAP_IPC_OWNER
ipc owner check and mlock
CAP_SYS_MODULE
insert and removal of kernel modules
CAP_SYS_RAWIO
ioperm/iopl access and usb messages
CAP_SYS_PACCT
process accounting
CAP_SYS_ADMIN
this list would be too long, it basically
alows to do everything else, not mentioned
in another capability.
CAP_SYS_BOOT
allow reboot/halt
CAP_SYS_NICE
allow raising priorities, and scheduler stuff
CAP_SYS_RESOURCE
override resource limits
override quota and reserved space
modify data journaling, colsoles, keymap
CAP_SYS_TIME
manipulation of the system clock
CAP_MKNOD
creation of kernel nodes
best,
Herbert
_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver
- Previous message: Herbert Poetzl: "Re: [Vserver] 1.3.1: save_s_context: fork: Resource temporarily unavailable [was: Re: 1.3.1 with quota/limit patches]"
- Next in thread: Frank Matthieß: "Kernel capabilties (Was: [Vserver] Vserver and Security)"
- Reply: Frank Matthieß: "Kernel capabilties (Was: [Vserver] Vserver and Security)"
- Reply: Gregory (Grisha) Trubetskoy: "Re: [Vserver] Vserver and Security"
| [[../|About this list]] | Date view | Thread view | Subject view | Author view | Attachment view |
|---|
[[[../|Next/Previous Months]]] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Thu 08 Jan 2004 - 19:13:36 GMT by hypermail 2.1.3