Difference between revisions of "Frequently Asked Questions scratch"

From Linux-VServer

Jump to: navigation, search
m
m
Line 225: Line 225:
 
  You must make sure the order of the interfaces are correct. The very first Interface (decided upon by alphabetical order of the interface directory name) for the VServer is the default IP used for all network connections. This must be either a public IP or an IP that has been D/SNAT'd.
 
  You must make sure the order of the interfaces are correct. The very first Interface (decided upon by alphabetical order of the interface directory name) for the VServer is the default IP used for all network connections. This must be either a public IP or an IP that has been D/SNAT'd.
 
|Signature=Linux-Vserver FAQ}}
 
|Signature=Linux-Vserver FAQ}}
 +
 +
 +
== G. Problematic Programs ==
 +
Some programs do things that might work on a normal host but not inside a V-Server. This is often not a fault of V-Server itself, the programs are doing automagic things which fail and no proper error handling is done. Also sometimes the actions need special rights which are not permitted by default in V-Servers. Allowing CAPs is often not necessary since those special CAPs are only required once (e.g. when the program initializes the directories/settings/whatever).
 +
 +
{{Question|Question=OpenGroupware Apache Module
 +
||Details=If your V-Server doesn't have access to localhost, then the connection to the !OpenGroupware server will fail with a "Internal Server Error".
 +
The apache module for !OpenGroupware called mod_ngobjweb uses a hardcoded "127.0.0.1" IP address in the source (handler.c line 339), this line you need to change to the IP address that should be used (the IP of the V-Server that runs the OpenGroupware server)|Signature=ProblematicPrograms}}
 +
 +
{{Question|Question=Hylafax (with CAPI)|Details=
 +
:If you want to run hylafax in a V-Server, you will get a CAP and device problem which can be easily solved. First you need your capi20 devices in your V-Server, which can't be created by ./MAKEDEV (requires special CAPs) so copy the devices into the V-Server, like this (command run on the host):
 +
:cp -aR /dev/capi* /vservers/your_vserver/dev
 +
:Now hylafax can access your CAPI ISDN card but will exit after a few seconds, the problem is it tries to create a /dev/null nod in the hylafax chroot. This fails because of missing  CAPs, so lets help hylafax again with copying the nod into the hylafax chroot in the V-Server. Like this (command run on the host):
 +
:cp -aR /dev/null /vservers/your_vserver/var/spool/hylafax/dev
 +
:Allright, now hylafax should have CAPI access and run properly.|Signature=ProblematicPrograms}}
 +
 +
{{Question|Question=Links inside screen inside a V-Server|Details=
 +
:Don't know why, but links crashes systematically being inside a screen session inside a V-Server started outside a V-Server. (please elaborate!)|Signature=ProblematicPrograms}}
 +
 +
{{Question|Question=screen inside a VServer|Details=
 +
 +
<pre>
 +
 +
[root@ge root]# vserver zoe enter
 +
 +
zoe:/# screen
 +
Cannot open your terminal '/dev/pts/5' - please check.
 +
 +
zoe:/# strace screen
 +
...
 +
stat64("/dev/pts/5", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 5), ...}) = 0
 +
open("/dev/pts/5", O_RDWR|O_NONBLOCK)  = -1 EACCES (Permission denied)
 +
 +
</pre>
 +
 +
:is neither a bug nor an issue with screen, it just shows that a vserver context is not allowed to mess with host terminals. either use ssh/telnet to reach the 'guest' or start the screen session before you do the 'enter' (i.e. on the host)|Signature=ProblematicPrograms}}
 +
 +
 +
{{Question|Question=!OpenLDAP Startup|Details=
 +
:slapd needs name resolution available in order to start up, otherwise it appears to hang. Make sure you have working DNS (or whatever) available to your vserver before starting one with slapd. This behavior is confirmed in my setup, no confirmation from others yet. My Setup: vservers all bind to an interface on a DMZ-like network segment, BIND runs on a vserver. slapd would hang at startup if the BIND vserver had not been started first.|Signature=ProblematicPrograms}}
 +
 +
{{Question|Question=rndc|Details=
 +
:Bind's rndc has a hardcoded 127.0.0.1 somewhere so any command to rndc will fail with connection refused.
 +
:You should have a reachable localhost address defined in /etc/hosts and then you can use rndc -s localhost command
 +
:You can make a rndc.conf and set the default-server option, like that the '-s localhost' isn't necessary.|Signature=ProblematicPrograms}}
 +
 +
{{Question|Question=Asterisk|Details=
 +
:Since some version of Asterisk (at least since 1.0.2), it will not run anymore. On start it fails with: "Unable to set high priority"
 +
:This can be solved by allowing CAP_SYS_NICE for that VServer.
 +
:You can also not run Asterisk with the realtime priority :
 +
:Just pass the '-p' command ligne argument to disable the read-time priority.
 +
:.
 +
:Good doc on setting up Asterisk devices in the vserver:
 +
:http://www.telephreak.org/papers/vpa/|Signature=ProblematicPrograms}}
 +
 +
 +
{{Question|Question=Open/!FreeSwan|Details=
 +
:Fails because of writing to /proc (requires patch)
 +
:TODO: write me|Signature=ProblematicPrograms}}
 +
 +
{{Question|Question=Samba|Details=
 +
:Oplocks don't work as smbd insists on receiving break requests from 127.0.0.1 \\
 +
Just patch source/smbd/oplock.c (commenting paranoid code)
 +
<pre>
 +
+++ oplock.c.orig      2005-02-14 14:27:51.000000000 +0200
 +
--- oplock.c    2005-02-02 12:27:50.000000000 +0200
 +
@@ -181,14 +181,12 @@
 +
                return False;
 +
        }
 +
 +
+#if 0
 +
    /* Validate message from address (must be localhost). */
 +
        if(from.sin_addr.s_addr != htonl(INADDR_LOOPBACK)) {
 +
                DEBUG(0,("receive_local_message: invalid 'from' address \
 +
(was %lx should be 127.0.0.1)\n", (long)from.sin_addr.s_addr));
 +
                return False;
 +
        }
 +
+#endif
 +
 +
        /* Setup the message header */
 +
        SIVAL(buffer,OPBRK_CMD_LEN_OFFSET,msg_len);
 +
</pre>
 +
or if you don't want to patch the samba source code you can disable oplock in Samba and it will work too!
 +
Just put the following in your smb.conf:
 +
<pre>
 +
kernel oplocks = no
 +
oplocks = no
 +
</pre>
 +
 +
Note: The Vserver using Samba should also listen on the broadcast address. Thereby you will not be able to have two samba servers in the same net (on the same broadcast). |Signature=ProblematicPrograms}}
 +
 +
{{Question|Question=Samba from Debian 3.1|Details=
 +
The samba deb in sarge (3.1) provided file sharing.  The only oddity observed is that the vserver guest running samba did not appear in a windows box's 'My Network Places'
 +
    Use a WINS server. The SMB browsing protocol relies heavily on broadcasts on the local net, which are problematic with vservers. WINS resolution on the other hand is unicast and works flawlessly under vserver.|Signature=ProblematicPrograms}}
 +
 +
 +
{{Question|Question=Samba printer and file server with cups|Details=
 +
:Samba runs correctly in a Mandriva (Mdk) 10.1 Vserver, (Apart from the above oplock problem ?).
 +
: \\
 +
First, edit your {{/etc/sysconfig/network}} file, and set {{networking}} to {{yes}} (This will solve problems for other services !):
 +
<pre>
 +
# cat /etc/sysconfig/network
 +
NETWORKING=yes
 +
</pre>
 +
: \\
 +
Some more tweaking is needeed in {{/etc/smb.conf}}:
 +
<pre>
 +
# cat /etc/smb.conf
 +
...
 +
  # YOUR VSERVER IP/MASK HERE
 +
  interfaces = xxx.xxx.xxx.xxx/mask
 +
...
 +
</pre>
 +
: \\
 +
That's all !!!
 +
: \\
 +
But if you're using Samba + Cups to provide printing for Windows clients, AND if you want to use the {{Point and Print}} feature, there is more: In the {{[printers]}} section of your {{smb.conf}}, you should have the {{use client drivers}} directive set to {{no}}, or the driver upload procedure will fail !
 +
<pre>
 +
# cat /etc/smb.conf
 +
...
 +
  use client driver = no
 +
...
 +
</pre>
 +
: \\
 +
So, here is a full {{smb.conf}} file:
 +
<pre>
 +
# cat /etc/samba/smb.conf | awk '!/^$/ && !/^\s*(#|;)/ {print $0}'
 +
[global]
 +
  workgroup = MYDOMAIN
 +
  netbios name = MYHOSTNAME
 +
  server string = MYCOMMENT (Samba %v)
 +
  printcap name = cups
 +
  load printers = yes
 +
  printing = cups
 +
  printer admin = @adm
 +
  log file = /var/log/samba/log.%m
 +
  max log size = 50
 +
  map to guest = bad user
 +
  security = domain
 +
  password server = *
 +
  encrypt passwords = yes
 +
  smb passwd file = /etc/samba/smbpasswd
 +
  username map = /etc/samba/smbusers
 +
  idmap uid = 10000-20000
 +
  idmap gid = 10000-20000
 +
  socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
 +
  interfaces = 127. MYVSERVERIP/MYVSERVERMASK
 +
  wins server = MYWINSIP
 +
  dns proxy = no
 +
  # for french users:
 +
  dos charset = 850
 +
  unix charset = ISO8859-1
 +
[homes]
 +
  comment = Home Directories
 +
  browseable = no
 +
  writable = no
 +
[printers]
 +
  comment = All Printers
 +
  path = /var/spool/samba
 +
  browseable = no
 +
  guest ok = no
 +
  writable = no
 +
  printable = yes
 +
  create mode = 0700
 +
  print command = lpr-cups -P %p -o raw %s -r  # using client side printer drivers.
 +
  use client driver = no
 +
[print$]
 +
  path = /var/lib/samba/printers
 +
  browseable = yes
 +
  write list = @adm root
 +
  guest ok = yes
 +
  inherit permissions = yes
 +
</pre>
 +
: \\
 +
...And a working smbusers:
 +
<pre>
 +
# Unix_name = SMB_name1 SMB_name2 ...
 +
root = administrator MYDOMAIN\administrator
 +
nobody = guest pcguest smbguest
 +
</pre>|Signature=ProblematicPrograms}}
 +
 +
{{Question|Question=Cups print server|Details=
 +
: Symptoms: The Cups init script exits with:
 +
<pre>
 +
Starting CUPS printing system: cupsd: Child exited with status 98!
 +
</pre>
 +
: \\
 +
And the logs ({{/var/log/cups/error_log}}) show:
 +
<pre>
 +
E [date:hour...] StartListening: Unable to bind socket for address 0.0.0.0:631 - Address already in use.
 +
</pre>
 +
:...Or something like this.
 +
: \\
 +
With a correct "cupsd.conf file" (Tested version 1.1.21-0.rc1.7mdk, on Mandrake 10.1 - Now Mandriva), it works; All we need is to remove references to {{127.0.0.1}} or {{localhost}} from the file, as well as correctly unsetting the {{Listen}} directive:
 +
<pre>
 +
LogLevel info
 +
TempDir /var/spool/cups/tmp
 +
# No 'Listen' directive !
 +
Port 631
 +
BrowseAddress @LOCAL
 +
BrowseDeny All
 +
BrowseAllow @LOCAL
 +
BrowseOrder deny,allow
 +
<Location />
 +
  Order Deny,Allow
 +
  Deny From All
 +
  Allow From @LOCAL
 +
</Location>
 +
<Location /admin>
 +
  AuthType Basic
 +
  AuthClass System
 +
  Order Deny,Allow
 +
  Deny From All
 +
  Allow From YOUR_NETWORK_ADDRESS/YOUR_NETMASK # Example: 172.16.0.0/24
 +
# Or
 +
  Allow From @LOCAL
 +
</Location>
 +
</pre>
 +
: \\
 +
Then you'll need to modify the {{/etc/init.d/cups}} script, to comment any section referring to {{127.0.0.1}} lookup and configuration. This section exists at least on Mandrake 10.1, and is pretty long (Lines 35 to 55 and/or 79), and additionnaly four "{{else...if}}" lines must be commented far below (Lines 161 to 164) !
 +
: \\
 +
Remember to stop any Cupsd running in the host server, or to start it ''via'' a wrapper {{/etc/init.d/v_cups}} script:
 +
<pre>
 +
#!/bin/sh
 +
# chkconfig: 2345 15 60
 +
# description: Wrapper to start cups bound to a single IP
 +
USR_LIB_VSERVER=/usr/lib/util-vserver
 +
exec $USR_LIB_VSERVER/vsysvwrapper cups $*
 +
</pre>
 +
: \\
 +
Do not forget to give a password to the root user, if you want to ba able to manage your printers from the web interface (http://yourcupsvserver:631)!
 +
<pre>
 +
# passwd root
 +
...
 +
</pre>
 +
: \\
 +
If you use Mandriva 10.1 (And maybe some other distros), you&#8217;ll need to add the printers drivers for Cups, and reload it:
 +
<pre>
 +
# urpmi --root /vservers/yourcupsvserver/ cups-drivers
 +
# /etc/init.d/cups reload
 +
</pre>
 +
: \\
 +
&#8230;It added 67 Mb of packages for me.
 +
: \\
 +
Then use {{/etc/init.d/v_cups (re)start}} to launch Cups on the host server.
 +
:You will now be able to make Cupsd start in the vserver , but more tweaking on the ACLs may be necessary to avoid authentification problems...|Signature=ProblematicPrograms}}
 +
 +
{{Question|Question=Bind9 on Debian GNU/Linux Woody (3.0) and Sarge (3.1)|Details=
 +
:named provided by the bind9 binary packages fails to start because it is compiled with CAPs option.
 +
: \\
 +
The debian way is to build** your own package without CAPs:
 +
: \\
 +
<pre>
 +
su -
 +
cd /usr/src
 +
apt-get build-dep bind9
 +
apt-get source bind9
 +
cd bind9-x.x.x
 +
vi debian/rules
 +
</pre>
 +
: \\
 +
Insert the following line after "./configure --prefix=/usr \":
 +
: \\
 +
<pre>
 +
--disable-linux-caps \
 +
</pre>
 +
: \\
 +
On a NPTL-enabled system you alse have to replace \\
 +
<pre>
 +
--enable-threads \
 +
</pre>
 +
: with \\
 +
<pre>
 +
--disable-threads \
 +
</pre>
 +
: or bind might refuse to run with an other user than root.
 +
: \\
 +
Save the file and go ahead with compiling/installing:
 +
: \\
 +
<pre>
 +
dpkg-buildpackage
 +
dpkg -i ../bind9-x.x.x.deb
 +
echo "bind9 hold" | dpkg --set-selections
 +
</pre>
 +
: \\
 +
The last line is to set the package "on hold", so it is not touched by the update process. you have to take care of security holes by yourself now!
 +
: \\
 +
The Xs in "bind9-x.x.x" denote the version number of bind9.
 +
: \\
 +
 +
** Alternatively you can allow the CAP_SYS_RESOURCE for that V-Server.
 +
 +
The best way would be to fix bind, which is somehow broken when it comes to capabilities.
 +
Daniel Hokka Zakrisson repaired it. His patch is to be found here:
 +
 +
[http://daniel.hozac.com/stuff/bind-9.3.2-caps-when-available.patch bind-9.3.2-caps-when-available.patch]
 +
So, if you recompile, it would be the cleanest way to apply that patch. Thanks Daniel!
 +
 +
It would be also nice, if someone submits that patch to the bind people or maybe to your distribution's package maintainers in the first step.
 +
 +
Get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian bind9 package] for Debian Sid guests. Feedback welcome: aj@net-lab.net|Signature=ProblematicPrograms}}
 +
 +
 +
{{Question|Question=Postfix 2.1.5 (Debian Sarge)|Details=
 +
:On a vserver with two interfaces (lo and eth0), and a postfix 2.1.5 listening on lo, postfix can't send emails : "Invalid argument"... Setting smtp_bind_address (http://www.postfix.org/postconf.5.html#smtp_bind_address) to the external address solves the issue.|Signature=ProblematicPrograms}}
 +
 +
 +
 +
 +
{{Question|Question=Zimbra Mail|Details=
 +
Zimbra is many applications (including Postfix and MySQL and OpenLDAP and more) which try to take over the interfaces, and depend a lot on binding from 127.0.0.1 - it is not hard to change, but there is a couple of tricks - it is documented here - http://wiki.zimbra.com/index.php?title=Install_VServer|Signature=ProblematicPrograms}}
 +
 +
 +
{{Question|Question=xine|Details=
 +
xine won't start with no error message.
 +
"xine --verbose" shows this.
 +
<pre>
 +
ERROR: Could not determine network interfaces, you must use a interfaces config line
 +
</pre>
 +
This happens if you have the xineplug_inp_smb.so plugin. Delete it and everything is fine.|Signature=ProblematicPrograms}}
 +
 +
 +
{{Question|Question=127.0.0.1 issues|Details=
 +
I had problems with an application that wanted me to access it on 127.0.0.1 and AS 127.0.0.1 to be able to do its configuration. A simple tweak solved the problem. I renamed the default interface directory "0" in /etc/vservers/server/interfaces to "1" and created interface 0 as :
 +
:dev lo
 +
:ip 127.0.0.1
 +
:mask 255.0.0.0
 +
:name lo
 +
 +
now interface "1" is the default created interface by the vserver build script with a local adress like 192.168.1.2 and interface "0" is the loopback. I can now telnet on 127.0.0.1 and it sees that im connecting to 127.0.0.1 from 127.0.0.1
 +
 +
Compiling nagios-1.4 within a vserver requires this, otherwise it hangs during the configure with "checking for ICMP ping syntax..."|Signature=ProblematicPrograms}}
 +
 +
 +
{{Question|Question=Hula-project|Details=
 +
Does not want to start :(|Signature=ProblematicPrograms}}

Revision as of 01:15, 29 August 2006

Contents

A. General

Credits

This FAQ includes information taken from the FAQs of Jacques Gélinas and Paul Sladen.
Linux-Vserver FAQ


Are there other FAQs available?

Yes. There are other (mostly older) FAQ's available:
Linux-Vserver FAQ


Where can I find a overview of Linux-VServer?

*((short presentation))
Linux-Vserver FAQ


How to verify that a setup is working properly?

*To verify that your setup works properly, there are some test scripts to check basic functionality. primarily testme.sh and testfs.sh (see ((TestScripts)) for more details)
Linux-Vserver FAQ



B. Requirements

What hardware is supported by linux-vserver?

The following platforms are supported in the stable versions of linux-vserver.
  • alpha
  • i386 and higher (and compatible)
  • ia32 / ia64
  • mips / mips64
  • hppa / hppa64
  • ppc / ppc64
  • sparc / sparc64
  • s390 / s390x
  • x86_64 (AMD64)
  • uml/xen
Linux-Vserver FAQ


Which kernel versions are supported?

recent 2.4 and 2.6 kernels (stable), recent 2.6 kernels (development). Some ancient versions of Linux-VServer are backported to 2.2.x kernels. You can find more information here.
Linux-Vserver FAQ


Can I run Linux-vserver on my favorite distribution?

Linux-VServer was originally developed on Red Hat/Mandriva, but it is rather distribution independent. It runs fine with other distributions (Debian, SuSE). Some distributions run a patched kernel, which can make it a bit harder to build a new kernel with Linux-VServer support
Linux-Vserver FAQ



C. Versions

What's the latest version of Linux-VServer?

You can find the latest stable 2.4 release or latest stable 2.6 release as well as the latest development release at http://www.13thfloor.at/vserver/ Check out the ((Release FAQ)) for information on releases and version numbering
Linux-Vserver FAQ


Where can I find prereleases and release candidates?

Check the experimental area for new patches.
Linux-Vserver FAQ



D. Tools (util-vserver and vserver)

What do I need them for?

These are the userspace tools for Linux-VServer. You need them to use the functionality of Linux-VServer.
Linux-Vserver FAQ


What's the difference between vserver and util-vserver?

The vserver package are the 'legacy utilities', written by Jacques Gélinas.

The util-vserver package is a reimplementation of these tools in C by Enrico Scholz, which follows the kernel development more closely. util-vserver tools are currently considered the mainstream tools (You can't use both packages on the same machine.)

Both packages have their own version numbering. Don't let the version numbering confuse you.
Linux-Vserver FAQ


Which version of the tools packages do I need? Do I have to upgrade?

*:It can be useful to have a recent version of the tools package installed on your box. It's a good idea to upgrade your tools when you upgrade your kernel. In the next list you find the versions you need to have at least, but it's a good idea to use more recent versions.
  • linux-vserver 1.00
    • vserver 0.26
    • util-vserver 0.24
  • linux-vserver 1.20
    • vserver 0.28
    • util-vserver 0.25
  • linux-vserver 2.00
    • util-vserver 0.30 or 0.30.209
Linux-Vserver FAQ



E. Download

Where can I dowload the latest version of:

Linux-Vserver FAQ


Distribution specific packages

*Red Hat
Linux-Vserver FAQ



F. Network Usage?

Is IPv6 supported?

At this moment, only IPv4 (the current most frequently used standard) is supported.
Linux-Vserver FAQ


Can I put my vservers in different networks?

Yes you can. You have to bind your vserver to a interface on the host machine, but you can choose the interface in the configuration file of your vserver (in /etc/vservers/SERVER.conf). Make sure your host server does have an interface in the network you need on your vserver.
Linux-Vserver FAQ


Is it possible for a vserver to have a other default gateway than the host machine does use?

Yes. Use iproute2 to set the default gateway. You can find more information on routing in linux-vserver in this posting on the mailinglist.
Linux-Vserver FAQ


Can I use more than one IP address in a vserver

Yes you can. Edit the configuration file of the vserver (/etc/vservers/SERVER.conf).

In case you want to use example IP addresses on one interface IPROOT="10.1.2.3 10.1.2.12" IPROOTDEV="eth0" In case you want to use 2 or more interfaces IPROOT="eth0:10.1.2.3 eth1:10.1.2.12" IPROOTDEV="" In case you want to use IP-number in different subnets IPROOT="eth0:10.1.2.3/255.255.255.0 eth0:10.1.3.12/255.255.0.0" IPROOTDEV="" If you are using vserver 2.0+ you have to create subdirectories in /etc/vserver/<vserver-name>/interfaces/ for each IP you want to use, i.e. /etc/vserver/<vserver-name>/interfaces/0 /etc/vserver/<vserver-name>/interfaces/1

These subdirectories have to contain files with the options you want to set. See the Flower page for more info
Linux-Vserver FAQ


Is it possible to use the real device (eth0, eth1) instead of the device alias created by vserver?

Yes. Set up the IP aliases yourself on the host server
  • Set IPROOT= to those IPs
  • Unset IPROOTDEV so the vserver script won't try to setup the IP aliases.
Linux-Vserver FAQ


Can I modify the behavior of my vservers?

There are a number of capabilities and flags that you can modify listed here (and here (cflags-v13.c)).
Linux-Vserver FAQ


Were can I find more information on networking in Linux-VServer?

You can find more information on the internals of networking in Linux-VServer here.
Linux-Vserver FAQ



G. Software compatibility

Bind does not work in a vserver

* capset failed
  • The bind package expect to have the capability CAP_SYS_RESOURCE. 
It expects this because it was compiled this way on Linux and to increase its ulimit.
  • By default, a vserver does not have this capability for a good reason, you may have a look at 'man capabilities' to see how much control that capability allows.
  • A vserver starts with some ulimit values and can only reduce them, not enlarge them.
  • If you know what you are doing, you can give the capability to the vserver running bind.
  • A securer solution is to compile bind without that requirement by specifying './configure --disable-linux-caps' 
It looks like you only can run bind as root once you compile bind with this option, but this should be fine inside a vserver.
  • bind does not respond to queries
  • Bind seems to have problems with a query socket check. Bind believes the query is comming on a non-query socket, and doesn't answer the request.
  • putting "query-source address YOUR_VSERVER_IP;" in your named.conf solves this problem.
Linux-Vserver FAQ


Is DHCP possible in a vserver?

It's possible to run a DHCP server inside a vserver, but it required a CAP_NET_RAW capability.

The solution for 2.6 kernel with new-style config is to add CAP_NET_RAW entry in the /etc/vserver/<vserver-name>/bcapabilities file, and it might be unnecessary to add 255.255.255.255 into bcast file, please read The Great Flower Page for more details. If you are still use the legacy config, please read the answer below. It's possible to run a DHCP server inside a vserver, but there is a catch. The set_ipv4root assigns one IP and one broadcast address to a vserver. UDP service listening to 0.0.0.0 (bind any) in a vserver are indeed listening to the vserver IP and vserver broadcast. This is all they will get. This is fine for most services. Unfortunately, dhcpd is receiving special broadcasts. Its clients are unaware of their IP number, so they are using special broadcast 255.255.255.255 address. A vserver generally runs with the broadcast address of the network device (the one used to setup the IP alias). This network device has a broadcast address which is never 255.255.255.255. Those special broadcast are not sent to the vserver. The solution is to set the IPROOTBCAST entry in the vserver configuration file like this IPROOTBCAST=255.255.255.255 Restart your vserver and dhcpd will work. There is a catch (at least with 2.4.18ctx-9). If you are using other services in the save vserver, also relying on broadcast for proper operation (samba for one), they won't operate properly. One solution would be to enhance the semantics a little: A vserver would listen for its IP address, its broadcast address and also for 255.255.255.255.

The dhcpd case is probably very specific though.
Linux-Vserver FAQ


NFS-server

It's not posible to run a NFS-kernel server inside a vserver, to work securely this would need a lot of work.

You can try to run the NFS userspace server, the traditional Linux user space NFS server and UNFS3 are both reported to work.

take a look at ((NFS and portmap)) if you have problems with your portmap
Linux-Vserver FAQ


Run Level Based Distributions as Ververs (Red Hat and such ....)

If you see errors after the command vserver <name> stop like these: 
Syncing hardware clock to system time hwclock is unable to get I/O port access:  the iopl(3) call failed FAILED]
Turning off swap:  Not superuser.    [FAILED]
Turning off quotas:  quotaoff: Can't stat() mounted device /dev/hdv1: No such file or directory
Unmounting file systems:  umount2: No such file or directory umount: /vservers: not found

Then look for S* links in /etc/rc6.d/ and remove the one responsible for the errors. In RH9 it is called S01reboot
A 'normal' server does some stuff on shutdown, like saving the time to the hwclock, or storing random pool data and finally invokes the reboot. Some of those actions are just not allowed in a vserver.
Linux-Vserver FAQ


Vservers and X Windows

Please see the ((Vservers and X)) page for information about this.
Linux-Vserver FAQ


sshd with X11-Forwarding in a vserver

add ```'X11UseLocalhost no'``` to your sshd_config
Linux-Vserver FAQ


See also: [ProblematicPrograms]

== H. Help ==
Linux-Vserver FAQ


Where can I find more information on the Linux-VServer project?

First have a look at the ((documentation)) section of the website. In case you can't find the answer here, have a look at the mailinglist archives. If this doesn't help jou, there is still a mailinglist and a IRC channel were you can ask for help.
Linux-Vserver FAQ


Does the Linux-VServer project have a mailing list?

Yes. You can subscribe here. Archives are located here.
Linux-Vserver FAQ


Is there a IRC channel

Yes, join #vserver on irc.oftc.net.
Linux-Vserver FAQ



I. Issues

When starting or entering a vserver I get "Error: /proc must be mounted". 'vserver-stat' and 'vps' are failing with "open("/proc/uptime"): No such file or directory". Sometimes, other files in /proc are mentioned. What can I do?

script. See ((Proc-Security)) also.
Linux-Vserver FAQ


Inside a vserver I can still use mknod to create devices, even without CAP_MKNOD capability. What's wrong? (this probably applies to all other capabilities but that was not tested)

This is probably a problem in your kernel configuration. If you include "Enable different security models" (CONFIG_SECURITY), then make sure to also include "Default Linux Capabilities" (CONFIG_SECURITY_CAPABILITIES) or compile it as a module. In this latter case you must insert the 'capability' module into the kernel. This is for example true for current (2.6.8.1) debian kernel configurations.
Linux-Vserver FAQ


After stopping/restarting a vserver my network is gone! What the hell?

See above.
Linux-Vserver FAQ


Only root can access any files in the vserver

Check the permissions of the vserver's / directory. The 2.4 branch's chroot-escape blocker (chmod 0000 and chattr +t) is meant to be applied to the directory containing the vservers (for example /vservers) not the vservers' root directories themselves. If you revoked all permissions for a vserver's root directory, re-grant them with "chmod 0755 /path/to/vserver-root".
Linux-Vserver FAQ


"daemon() failed: Success" - What? Succesfully failing?

Not really vserver related but here's the answer: Somebody replaced your /dev/null with a regular file, create a real /dev/null and it will start working again. We got no idea why the error message happens to be so funny(?).
Linux-Vserver FAQ


When I start a vserver, "FATAL: kernel too old" message appears and vserver can't be started

Edit your /etc/vservers/<vsname>/uts/release and define a value greater than kernel version example, if you have a kernel "2.6.11", set "2005" for example  :-)
Linux-Vserver FAQ


I switched from old to new configuration and now all my ip addresses are gone!

They are not, ifconfig just doesn't show them. The new tools use 'iproute' instead of 'ifconfig' which allows you to use multiple interface addresses with the same label. In such cases, ifconfig shows only the first address for each label, which probably isn't available in the vserver. Unless you specify a name for an ip address, it will be given the interface name as label, eg. eth0, and ifconfig breaks. You can assign names to your interface addresses in the vserver configuration, see The Great Flower Page for details. Earlier, we said that the interface addresses were "nameless", this was wrong. As said above, the addresses in question actually all have the same name/label. Knowing this we could actually virtualize the ioctl interface which ifconfig uses in a meaningful way, making ifconfig show the vserver's ip addresses as expected, even when it shares its label with other ip addresses (of course only if there aren't multiple ip addresses in the same vserver that share the same label, but that's an ifconfig limitation, not a vserver bug). The patch should apply to most Linux-VServer versions for kernel 2.6 and will probably be included in future versions.
Linux-Vserver FAQ


When I enter/ssh into a vserver I can see all of the interfaces and interface aliases with ifconfig.

I experienced this after upgrading from a 2.4 to 2.6 kernel with vs-2.0 patch using legacy-method .conf files. Upgrading from legacy-method to the new one (see Converting From Legacy to New) caused the problem to go away.
Linux-Vserver FAQ


I keep my vserver roots on their own devices. I can unmount them but the device (like drbd or lvm) remains in use until all of my vservers are killed off ("Someone has opened the device for RW access").

When you mount something it is recorded in the current namespace. When you start a vserver it makes copy of the namespace. You can then unmount in the original namespace without any problems, however the device is still in use. This is because the device is still mounted in the new namespace. You can do something like this: "vnamespace -e runningVserver umount /mnt/point". After this you should be able to remove the device (drbdadm secondary /dev/drbd0 or whatever).

More information:

WARNING: if you use the kernel cleanup feature then make sure you know what you are doing. I didn't, it was ugly.
Linux-Vserver FAQ


When I stop a vserver its network alias does not go away, I am getting 'RTNETLINK answers: Cannot assign requested address

'

Try running 'ip addr' and see if the interface names are being truncated (note: I came across a thread that seems to suggest that this might happen even if the interface name is not being truncated?). The function that kills the interface specifies its name, if it is truncated then 'ip' will not be able to find the interface. Another cause might be that the IP was added (or already present at startup) with a different netmask, and therfore can not be removed properly My solution to this is very, very gross. Open up your vserver.functions file and find the disableInterfaces function. If you change IP_ADDR) $_IP addr del "$@";; to

IP_ADDR) $(echo $_IP addr del "$@"
Linux-Vserver FAQ


Why does the vserver run on a BSD fs (ufs) ?!

* I see something like: /dev/hdv1 / ufs defaults 0 0

The ufs part is correct and it is so to trick the quota tools to not try to lowlevel access the fs. The entry is FAKE anyway, ufs just solved this quota userland issue nicely (more or less).

  • For details see: [1] and [2]
  • When I issue a ping it returns: 
[root@VServerGuest /]# ping 123.123.123.123
connect: Invalid argument
  • When I issue a DNS lookup it returns: 
[root@VServerGuest /]# host www.yahoo.ca
socket.c: internal_send: 222.222.222.222#53: Invalid argument
;; connection timed out; no servers could be reached
  • When I try to run vyum it returns: 
[root@VServerGuest /]# vyum VServerGuest -- check-update
Cannot find a valid baseurl for repo: core
Error: Cannot find a valid baseurl for repo: core
Make sure that you have either a Public IP setup on the VServer Guest, or that you have a proper SNAT/DNAT rules setup on your VServer Host. After that, restart the vserver guest with the verbose option to see what your ipv4root is set to:
[root@VServerGuest  /]# vserver -v VServerGuest start
ipv4root is now 127.0.0.10 111.111.111.111
New security context is 49156
You must make sure the order of the interfaces are correct. The very first Interface (decided upon by alphabetical order of the interface directory name) for the VServer is the default IP used for all network connections. This must be either a public IP or an IP that has been D/SNAT'd.
Linux-Vserver FAQ



G. Problematic Programs

Some programs do things that might work on a normal host but not inside a V-Server. This is often not a fault of V-Server itself, the programs are doing automagic things which fail and no proper error handling is done. Also sometimes the actions need special rights which are not permitted by default in V-Servers. Allowing CAPs is often not necessary since those special CAPs are only required once (e.g. when the program initializes the directories/settings/whatever).


OpenGroupware Apache Module

If your V-Server doesn't have access to localhost, then the connection to the !OpenGroupware server will fail with a "Internal Server Error". The apache module for !OpenGroupware called mod_ngobjweb uses a hardcoded "127.0.0.1" IP address in the source (handler.c line 339), this line you need to change to the IP address that should be used (the IP of the V-Server that runs the OpenGroupware server)
ProblematicPrograms



Hylafax (with CAPI)

:If you want to run hylafax in a V-Server, you will get a CAP and device problem which can be easily solved. First you need your capi20 devices in your V-Server, which can't be created by ./MAKEDEV (requires special CAPs) so copy the devices into the V-Server, like this (command run on the host):
cp -aR /dev/capi* /vservers/your_vserver/dev
Now hylafax can access your CAPI ISDN card but will exit after a few seconds, the problem is it tries to create a /dev/null nod in the hylafax chroot. This fails because of missing CAPs, so lets help hylafax again with copying the nod into the hylafax chroot in the V-Server. Like this (command run on the host):
cp -aR /dev/null /vservers/your_vserver/var/spool/hylafax/dev
Allright, now hylafax should have CAPI access and run properly.
ProblematicPrograms



Links inside screen inside a V-Server

:Don't know why, but links crashes systematically being inside a screen session inside a V-Server started outside a V-Server. (please elaborate!)
ProblematicPrograms



screen inside a VServer 


[root@ge root]# vserver zoe enter

zoe:/# screen
Cannot open your terminal '/dev/pts/5' - please check.

zoe:/# strace screen 
...
stat64("/dev/pts/5", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 5), ...}) = 0
open("/dev/pts/5", O_RDWR|O_NONBLOCK)   = -1 EACCES (Permission denied)
is neither a bug nor an issue with screen, it just shows that a vserver context is not allowed to mess with host terminals. either use ssh/telnet to reach the 'guest' or start the screen session before you do the 'enter' (i.e. on the host)
ProblematicPrograms




!OpenLDAP Startup

:slapd needs name resolution available in order to start up, otherwise it appears to hang. Make sure you have working DNS (or whatever) available to your vserver before starting one with slapd. This behavior is confirmed in my setup, no confirmation from others yet. My Setup: vservers all bind to an interface on a DMZ-like network segment, BIND runs on a vserver. slapd would hang at startup if the BIND vserver had not been started first.
ProblematicPrograms



rndc

:Bind's rndc has a hardcoded 127.0.0.1 somewhere so any command to rndc will fail with connection refused.
You should have a reachable localhost address defined in /etc/hosts and then you can use rndc -s localhost command
You can make a rndc.conf and set the default-server option, like that the '-s localhost' isn't necessary.
ProblematicPrograms



Asterisk

:Since some version of Asterisk (at least since 1.0.2), it will not run anymore. On start it fails with: "Unable to set high priority"
This can be solved by allowing CAP_SYS_NICE for that VServer.
You can also not run Asterisk with the realtime priority :
Just pass the '-p' command ligne argument to disable the read-time priority.
.
Good doc on setting up Asterisk devices in the vserver:
http://www.telephreak.org/papers/vpa/
ProblematicPrograms




Open/!FreeSwan

:Fails because of writing to /proc (requires patch)
TODO: write me
ProblematicPrograms



Samba

:Oplocks don't work as smbd insists on receiving break requests from 127.0.0.1 \\

Just patch source/smbd/oplock.c (commenting paranoid code) 

+++ oplock.c.orig       2005-02-14 14:27:51.000000000 +0200
--- oplock.c    2005-02-02 12:27:50.000000000 +0200
@@ -181,14 +181,12 @@
                return False;
        }

+#if 0
     /* Validate message from address (must be localhost). */
        if(from.sin_addr.s_addr != htonl(INADDR_LOOPBACK)) {
                DEBUG(0,("receive_local_message: invalid 'from' address \
 (was %lx should be 127.0.0.1)\n", (long)from.sin_addr.s_addr));
                return False;
        }
+#endif

        /* Setup the message header */
        SIVAL(buffer,OPBRK_CMD_LEN_OFFSET,msg_len);

or if you don't want to patch the samba source code you can disable oplock in Samba and it will work too! Just put the following in your smb.conf: 

kernel oplocks = no
oplocks = no
Note: The Vserver using Samba should also listen on the broadcast address. Thereby you will not be able to have two samba servers in the same net (on the same broadcast).
ProblematicPrograms



Samba from Debian 3.1

The samba deb in sarge (3.1) provided file sharing. The only oddity observed is that the vserver guest running samba did not appear in a windows box's 'My Network Places' Use a WINS server. The SMB browsing protocol relies heavily on broadcasts on the local net, which are problematic with vservers. WINS resolution on the other hand is unicast and works flawlessly under vserver.
ProblematicPrograms




Samba printer and file server with cups

:Samba runs correctly in a Mandriva (Mdk) 10.1 Vserver, (Apart from the above oplock problem ?).
\\

First, edit your Template:/etc/sysconfig/network file, and set Template:Networking to Template:Yes (This will solve problems for other services !): 

# cat /etc/sysconfig/network
NETWORKING=yes
\\

Some more tweaking is needeed in Template:/etc/smb.conf: 

# cat /etc/smb.conf
...
  # YOUR VSERVER IP/MASK HERE
  interfaces = xxx.xxx.xxx.xxx/mask
...
\\

That's all !!!

\\

But if you're using Samba + Cups to provide printing for Windows clients, AND if you want to use the Template:Point and Print feature, there is more: In the {{[printers]}} section of your Template:Smb.conf, you should have the Template:Use client drivers directive set to Template:No, or the driver upload procedure will fail ! 

# cat /etc/smb.conf
...
  use client driver = no
...
\\

So, here is a full Template:Smb.conf file: 

# cat /etc/samba/smb.conf | awk '!/^$/ && !/^\s*(#|;)/ {print $0}'
[global]
   workgroup = MYDOMAIN
   netbios name = MYHOSTNAME
   server string = MYCOMMENT (Samba %v)
   printcap name = cups
   load printers = yes
   printing = cups
   printer admin = @adm
   log file = /var/log/samba/log.%m
   max log size = 50
   map to guest = bad user
   security = domain
   password server = *
   encrypt passwords = yes
   smb passwd file = /etc/samba/smbpasswd
   username map = /etc/samba/smbusers
   idmap uid = 10000-20000
   idmap gid = 10000-20000
   socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
   interfaces = 127. MYVSERVERIP/MYVSERVERMASK
   wins server = MYWINSIP
   dns proxy = no
   # for french users:
   dos charset = 850
   unix charset = ISO8859-1
[homes]
   comment = Home Directories
   browseable = no
   writable = no
[printers]
   comment = All Printers
   path = /var/spool/samba
   browseable = no
   guest ok = no
   writable = no
   printable = yes
   create mode = 0700
   print command = lpr-cups -P %p -o raw %s -r   # using client side printer drivers.
   use client driver = no
[print$]
   path = /var/lib/samba/printers
   browseable = yes
   write list = @adm root
   guest ok = yes
   inherit permissions = yes
\\

...And a working smbusers: 

# Unix_name = SMB_name1 SMB_name2 ...
root = administrator MYDOMAIN\administrator
nobody = guest pcguest smbguest
ProblematicPrograms



Cups print server

: Symptoms: The Cups init script exits with: 
Starting CUPS printing system: cupsd: Child exited with status 98!
\\

And the logs (Template:/var/log/cups/error log) show: 

E [date:hour...] StartListening: Unable to bind socket for address 0.0.0.0:631 - Address already in use.
...Or something like this.
\\

With a correct "cupsd.conf file" (Tested version 1.1.21-0.rc1.7mdk, on Mandrake 10.1 - Now Mandriva), it works; All we need is to remove references to Template:127.0.0.1 or Template:Localhost from the file, as well as correctly unsetting the Template:Listen directive: 

LogLevel info
TempDir /var/spool/cups/tmp
# No 'Listen' directive !
Port 631
BrowseAddress @LOCAL
BrowseDeny All
BrowseAllow @LOCAL
BrowseOrder deny,allow
<Location />
  Order Deny,Allow
  Deny From All
  Allow From @LOCAL
</Location>
<Location /admin>
  AuthType Basic
  AuthClass System
  Order Deny,Allow
  Deny From All
  Allow From YOUR_NETWORK_ADDRESS/YOUR_NETMASK # Example: 172.16.0.0/24
# Or
  Allow From @LOCAL
</Location>
\\

Then you'll need to modify the Template:/etc/init.d/cups script, to comment any section referring to Template:127.0.0.1 lookup and configuration. This section exists at least on Mandrake 10.1, and is pretty long (Lines 35 to 55 and/or 79), and additionnaly four "Template:Else...if" lines must be commented far below (Lines 161 to 164) !

\\

Remember to stop any Cupsd running in the host server, or to start it via a wrapper Template:/etc/init.d/v cups script: 

#!/bin/sh
# chkconfig: 2345 15 60
# description: Wrapper to start cups bound to a single IP
USR_LIB_VSERVER=/usr/lib/util-vserver
exec $USR_LIB_VSERVER/vsysvwrapper cups $*
\\

Do not forget to give a password to the root user, if you want to ba able to manage your printers from the web interface (http://yourcupsvserver:631)! 

# passwd root
...
\\

If you use Mandriva 10.1 (And maybe some other distros), you’ll need to add the printers drivers for Cups, and reload it: 

# urpmi --root /vservers/yourcupsvserver/ cups-drivers
# /etc/init.d/cups reload
\\

…It added 67 Mb of packages for me.

\\

Then use Template:/etc/init.d/v cups (re)start to launch Cups on the host server.

You will now be able to make Cupsd start in the vserver , but more tweaking on the ACLs may be necessary to avoid authentification problems...
ProblematicPrograms



Bind9 on Debian GNU/Linux Woody (3.0) and Sarge (3.1)

:named provided by the bind9 binary packages fails to start because it is compiled with CAPs option.
\\

The debian way is to build** your own package without CAPs:

\\ 
su -
cd /usr/src
apt-get build-dep bind9
apt-get source bind9
cd bind9-x.x.x
vi debian/rules
\\

Insert the following line after "./configure --prefix=/usr \":

\\ 
--disable-linux-caps \
\\

On a NPTL-enabled system you alse have to replace \\ 

--enable-threads \
with \\ 
--disable-threads \
or bind might refuse to run with an other user than root.
\\

Save the file and go ahead with compiling/installing:

\\ 
dpkg-buildpackage
dpkg -i ../bind9-x.x.x.deb
echo "bind9 hold" | dpkg --set-selections
\\

The last line is to set the package "on hold", so it is not touched by the update process. you have to take care of security holes by yourself now!

\\

The Xs in "bind9-x.x.x" denote the version number of bind9.

\\
    • Alternatively you can allow the CAP_SYS_RESOURCE for that V-Server.

The best way would be to fix bind, which is somehow broken when it comes to capabilities. Daniel Hokka Zakrisson repaired it. His patch is to be found here:

bind-9.3.2-caps-when-available.patch So, if you recompile, it would be the cleanest way to apply that patch. Thanks Daniel!

It would be also nice, if someone submits that patch to the bind people or maybe to your distribution's package maintainers in the first step.

Get my vserver-guest-ready Debian bind9 package for Debian Sid guests. Feedback welcome: aj@net-lab.net
ProblematicPrograms




Postfix 2.1.5 (Debian Sarge)

:On a vserver with two interfaces (lo and eth0), and a postfix 2.1.5 listening on lo, postfix can't send emails : "Invalid argument"... Setting smtp_bind_address (http://www.postfix.org/postconf.5.html#smtp_bind_address) to the external address solves the issue.
ProblematicPrograms





Zimbra Mail

Zimbra is many applications (including Postfix and MySQL and OpenLDAP and more) which try to take over the interfaces, and depend a lot on binding from 127.0.0.1 - it is not hard to change, but there is a couple of tricks - it is documented here - http://wiki.zimbra.com/index.php?title=Install_VServer
ProblematicPrograms




xine

xine won't start with no error message.

"xine --verbose" shows this. 

ERROR: Could not determine network interfaces, you must use a interfaces config line
This happens if you have the xineplug_inp_smb.so plugin. Delete it and everything is fine.
ProblematicPrograms




127.0.0.1 issues

I had problems with an application that wanted me to access it on 127.0.0.1 and AS 127.0.0.1 to be able to do its configuration. A simple tweak solved the problem. I renamed the default interface directory "0" in /etc/vservers/server/interfaces to "1" and created interface 0 as :
dev lo
ip 127.0.0.1
mask 255.0.0.0
name lo

now interface "1" is the default created interface by the vserver build script with a local adress like 192.168.1.2 and interface "0" is the loopback. I can now telnet on 127.0.0.1 and it sees that im connecting to 127.0.0.1 from 127.0.0.1

Compiling nagios-1.4 within a vserver requires this, otherwise it hangs during the configure with "checking for ICMP ping syntax..."
ProblematicPrograms




Hula-project

Does not want to start :(
ProblematicPrograms


Retrieved from "http://linux-vserver.org/index.php?title=Frequently_Asked_Questions_scratch&oldid=1619"
Personal tools