Frequently Asked Questions scratch
From Linux-VServer
A. General
Credits
Are there other FAQs available?
Where can I find a overview of Linux-VServer?
- Wikipedia Article
- ProjectOverview (an introduction to the VServer Project, by ChuckD)
- Introduction by Jacques Gélinas
How to verify that a setup is working properly?
B. Requirements
What hardware is supported by linux-vserver?
- alpha
- i386 and higher (and compatible)
- ia32 / ia64
- mips / mips64
- hppa / hppa64
- ppc / ppc64
- sparc / sparc64
- s390 / s390x
- x86_64 (AMD64)
- uml/xen
Which kernel versions are supported?
Can I run Linux-vserver on my favorite distribution?
C. Versions
What's the latest version of Linux-VServer?
Where can I find prereleases and release candidates?
D. Tools (util-vserver and vserver)
What do I need them for?
What's the difference between vserver and util-vserver?
The util-vserver package is a reimplementation of these tools in C by Enrico Scholz, which follows the kernel development more closely. util-vserver tools are currently considered the mainstream tools (You can't use both packages on the same machine.)
Both packages have their own version numbering. Don't let the version numbering confuse you.
Which version of the tools packages do I need? Do I have to upgrade?
- linux-vserver 1.00
- vserver 0.26
- util-vserver 0.24
- linux-vserver 1.20
- vserver 0.28
- util-vserver 0.25
- linux-vserver 2.00
- util-vserver 0.30 or 0.30.209
E. Download
Distribution specific packages
- Mandrake
- Debian
- vserver - All Linux-VServer-related Debian-packages (Probably slow, +100 results).
- Official precompiled kernels - These are the official Debian kernels compiled with Linux-VServer-support.
- vserver-debiantools - These scripts install Debian straight off the web from Debian.org's world-wide network of mirrors.
- Gentoo
F. Network Usage?
Is IPv6 supported?
Can I put my vservers in different networks?
Is it possible for a vserver to have a other default gateway than the host machine does use?
Can I use more than one IP address in a vserver
In case you want to use example IP addresses on one interface IPROOT="10.1.2.3 10.1.2.12" IPROOTDEV="eth0" In case you want to use 2 or more interfaces IPROOT="eth0:10.1.2.3 eth1:10.1.2.12" IPROOTDEV="" In case you want to use IP-number in different subnets IPROOT="eth0:10.1.2.3/255.255.255.0 eth0:10.1.3.12/255.255.0.0" IPROOTDEV="" If you are using vserver 2.0+ you have to create subdirectories in /etc/vserver/<vserver-name>/interfaces/ for each IP you want to use, i.e. /etc/vserver/<vserver-name>/interfaces/0 /etc/vserver/<vserver-name>/interfaces/1
These subdirectories have to contain files with the options you want to set. See the VServerConfiguration or Flower page for more info
Is it possible to use the real device (eth0, eth1) instead of the device alias created by vserver?
- Set IPROOT= to those IPs
- Unset IPROOTDEV so the vserver script won't try to setup the IP aliases.
Can I modify the behavior of my vservers?
Were can I find more information on networking in Linux-VServer?
G. Software compatibility
Bind does not work in a vserver
- The bind package expect to have the capability CAP_SYS_RESOURCE.
It expects this because it was compiled this way on Linux and to increase its ulimit.
- By default, a vserver does not have this capability for a good reason, you may have a look at 'man capabilities' to see how much control that capability allows.
- A vserver starts with some ulimit values and can only reduce them, not enlarge them.
- If you know what you are doing, you can give the capability to the vserver running bind.
- A securer solution is to compile bind without that requirement by specifying './configure --disable-linux-caps'
It looks like you only can run bind as root once you compile bind with this option, but this should be fine inside a vserver.
- bind does not respond to queries
- Bind seems to have problems with a query socket check. Bind believes the query is comming on a non-query socket, and doesn't answer the request.
- putting "query-source address YOUR_VSERVER_IP;" in your named.conf solves this problem.
Is DHCP possible in a vserver?
The solution for 2.6 kernel with new-style config is to add CAP_NET_RAW entry in the /etc/vserver/<vserver-name>/bcapabilities file, and it might be unnecessary to add 255.255.255.255 into bcast file, please read VServerConfiguration or The Great Flower Page for more details. If you are still use the legacy config, please read the answer below. It's possible to run a DHCP server inside a vserver, but there is a catch. The set_ipv4root assigns one IP and one broadcast address to a vserver. UDP service listening to 0.0.0.0 (bind any) in a vserver are indeed listening to the vserver IP and vserver broadcast. This is all they will get. This is fine for most services. Unfortunately, dhcpd is receiving special broadcasts. Its clients are unaware of their IP number, so they are using special broadcast 255.255.255.255 address. A vserver generally runs with the broadcast address of the network device (the one used to setup the IP alias). This network device has a broadcast address which is never 255.255.255.255. Those special broadcast are not sent to the vserver. The solution is to set the IPROOTBCAST entry in the vserver configuration file like this IPROOTBCAST=255.255.255.255 Restart your vserver and dhcpd will work. There is a catch (at least with 2.4.18ctx-9). If you are using other services in the save vserver, also relying on broadcast for proper operation (samba for one), they won't operate properly. One solution would be to enhance the semantics a little: A vserver would listen for its IP address, its broadcast address and also for 255.255.255.255.
The dhcpd case is probably very specific though.
NFS-server
You can try to run the NFS userspace server, the traditional Linux user space NFS server and UNFS3 are both reported to work.
take a look at ((NFS and portmap)) if you have problems with your portmap
Run Level Based Distributions as Ververs (Red Hat and such ....)
Syncing hardware clock to system time hwclock is unable to get I/O port access: the iopl(3) call failed FAILED] Turning off swap: Not superuser. [FAILED] Turning off quotas: quotaoff: Can't stat() mounted device /dev/hdv1: No such file or directory Unmounting file systems: umount2: No such file or directory umount: /vservers: not found
Then look for S* links in /etc/rc6.d/ and remove the one responsible for the errors. In RH9 it is called S01rebootA 'normal' server does some stuff on shutdown, like saving the time to the hwclock, or storing random pool data and finally invokes the reboot. Some of those actions are just not allowed in a vserver.
Vservers and X Windows
sshd with X11-Forwarding in a vserver
See also: [ProblematicPrograms]
Where can I find more information on the Linux-VServer project?
Does the Linux-VServer project have a mailing list?
Is there a IRC channel
I. Issues
When starting or entering a vserver I get "Error: /proc must be mounted". 'vserver-stat' and 'vps' are failing with "open("/proc/uptime"): No such file or directory". Sometimes, other files in /proc are mentioned. What can I do?
Inside a vserver I can still use mknod to create devices, even without CAP_MKNOD capability. What's wrong? (this probably applies to all other capabilities but that was not tested)
After stopping/restarting a vserver my network is gone! What the hell?
Only root can access any files in the vserver
"daemon() failed: Success" - What? Succesfully failing?
When I start a vserver, "FATAL: kernel too old" message appears and vserver can't be started
I switched from old to new configuration and now all my ip addresses are gone!
When I enter/ssh into a vserver I can see all of the interfaces and interface aliases with ifconfig.
I keep my vserver roots on their own devices. I can unmount them but the device (like drbd or lvm) remains in use until all of my vservers are killed off ("Someone has opened the device for RW access").
More information:
- About Namespaces
- DRBD Mount Issues
- This thread, which deals with the same issue.
- This thread, terse but helpful.
- And this, a thread of related stuff.
When I stop a vserver its network alias does not go away, I am getting 'RTNETLINK answers: Cannot assign requested address
Try running 'ip addr' and see if the interface names are being truncated (note: I came across a thread that seems to suggest that this might happen even if the interface name is not being truncated?). The function that kills the interface specifies its name, if it is truncated then 'ip' will not be able to find the interface. Another cause might be that the IP was added (or already present at startup) with a different netmask, and therfore can not be removed properly My solution to this is very, very gross. Open up your vserver.functions file and find the disableInterfaces function. If you change IP_ADDR) $_IP addr del "$@";; to
IP_ADDR) $(echo $_IP addr del "$@"
Why does the vserver run on a BSD fs (ufs) ?!
The ufs part is correct and it is so to trick the quota tools to not try to lowlevel access the fs. The entry is FAKE anyway, ufs just solved this quota userland issue nicely (more or less).
[root@VServerGuest /]# ping 123.123.123.123 connect: Invalid argument
- When I issue a DNS lookup it returns:
[root@VServerGuest /]# host www.yahoo.ca socket.c: internal_send: 222.222.222.222#53: Invalid argument ;; connection timed out; no servers could be reached
- When I try to run vyum it returns:
[root@VServerGuest /]# vyum VServerGuest -- check-update Cannot find a valid baseurl for repo: core Error: Cannot find a valid baseurl for repo: core Make sure that you have either a Public IP setup on the VServer Guest, or that you have a proper SNAT/DNAT rules setup on your VServer Host. After that, restart the vserver guest with the verbose option to see what your ipv4root is set to: [root@VServerGuest /]# vserver -v VServerGuest start ipv4root is now 127.0.0.10 111.111.111.111 New security context is 49156You must make sure the order of the interfaces are correct. The very first Interface (decided upon by alphabetical order of the interface directory name) for the VServer is the default IP used for all network connections. This must be either a public IP or an IP that has been D/SNAT'd.
G. Problematic Programs
Some programs do things that might work on a normal host but not inside a V-Server. This is often not a fault of V-Server itself, the programs are doing automagic things which fail and no proper error handling is done. Also sometimes the actions need special rights which are not permitted by default in V-Servers. Allowing CAPs is often not necessary since those special CAPs are only required once (e.g. when the program initializes the directories/settings/whatever).
OpenGroupware Apache Module
Hylafax (with CAPI)
- cp -aR /dev/capi* /vservers/your_vserver/dev
- Now hylafax can access your CAPI ISDN card but will exit after a few seconds, the problem is it tries to create a /dev/null nod in the hylafax chroot. This fails because of missing CAPs, so lets help hylafax again with copying the nod into the hylafax chroot in the V-Server. Like this (command run on the host):
- cp -aR /dev/null /vservers/your_vserver/var/spool/hylafax/dev
- Allright, now hylafax should have CAPI access and run properly.
Links inside screen inside a V-Server
screen inside a VServer
[root@ge root]# vserver zoe enter
zoe:/# screen
Cannot open your terminal '/dev/pts/5' - please check.
zoe:/# strace screen
...
stat64("/dev/pts/5", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 5), ...}) = 0
open("/dev/pts/5", O_RDWR|O_NONBLOCK) = -1 EACCES (Permission denied)
- is neither a bug nor an issue with screen, it just shows that a vserver context is not allowed to mess with host terminals. either use ssh/telnet to reach the 'guest' or start the screen session before you do the 'enter' (i.e. on the host)
!OpenLDAP Startup
rndc
- You should have a reachable localhost address defined in /etc/hosts and then you can use rndc -s localhost command
- You can make a rndc.conf and set the default-server option, like that the '-s localhost' isn't necessary.
Asterisk
- This can be solved by allowing CAP_SYS_NICE for that VServer.
- You can also not run Asterisk with the realtime priority :
- Just pass the '-p' command ligne argument to disable the read-time priority.
- .
- Good doc on setting up Asterisk devices in the vserver:
- http://www.telephreak.org/papers/vpa/
Open/!FreeSwan
- TODO: write me
Samba
Just patch source/smbd/oplock.c (commenting paranoid code)
+++ oplock.c.orig 2005-02-14 14:27:51.000000000 +0200
--- oplock.c 2005-02-02 12:27:50.000000000 +0200
@@ -181,14 +181,12 @@
return False;
}
+#if 0
/* Validate message from address (must be localhost). */
if(from.sin_addr.s_addr != htonl(INADDR_LOOPBACK)) {
DEBUG(0,("receive_local_message: invalid 'from' address \
(was %lx should be 127.0.0.1)\n", (long)from.sin_addr.s_addr));
return False;
}
+#endif
/* Setup the message header */
SIVAL(buffer,OPBRK_CMD_LEN_OFFSET,msg_len);
or if you don't want to patch the samba source code you can disable oplock in Samba and it will work too! Just put the following in your smb.conf:
kernel oplocks = no oplocks = noNote: The Vserver using Samba should also listen on the broadcast address. Thereby you will not be able to have two samba servers in the same net (on the same broadcast).
Samba from Debian 3.1
Samba printer and file server with cups
- \\
First, edit your Template:/etc/sysconfig/network file, and set Template:Networking to Template:Yes (This will solve problems for other services !):
# cat /etc/sysconfig/network NETWORKING=yes
- \\
Some more tweaking is needeed in Template:/etc/smb.conf:
# cat /etc/smb.conf ... # YOUR VSERVER IP/MASK HERE interfaces = xxx.xxx.xxx.xxx/mask ...
- \\
That's all !!!
- \\
But if you're using Samba + Cups to provide printing for Windows clients, AND if you want to use the Template:Point and Print feature, there is more: In the {{[printers]}} section of your Template:Smb.conf, you should have the Template:Use client drivers directive set to Template:No, or the driver upload procedure will fail !
# cat /etc/smb.conf ... use client driver = no ...
- \\
So, here is a full Template:Smb.conf file:
# cat /etc/samba/smb.conf | awk '!/^$/ && !/^\s*(#|;)/ {print $0}'
[global]
workgroup = MYDOMAIN
netbios name = MYHOSTNAME
server string = MYCOMMENT (Samba %v)
printcap name = cups
load printers = yes
printing = cups
printer admin = @adm
log file = /var/log/samba/log.%m
max log size = 50
map to guest = bad user
security = domain
password server = *
encrypt passwords = yes
smb passwd file = /etc/samba/smbpasswd
username map = /etc/samba/smbusers
idmap uid = 10000-20000
idmap gid = 10000-20000
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
interfaces = 127. MYVSERVERIP/MYVSERVERMASK
wins server = MYWINSIP
dns proxy = no
# for french users:
dos charset = 850
unix charset = ISO8859-1
[homes]
comment = Home Directories
browseable = no
writable = no
[printers]
comment = All Printers
path = /var/spool/samba
browseable = no
guest ok = no
writable = no
printable = yes
create mode = 0700
print command = lpr-cups -P %p -o raw %s -r # using client side printer drivers.
use client driver = no
[print$]
path = /var/lib/samba/printers
browseable = yes
write list = @adm root
guest ok = yes
inherit permissions = yes
- \\
...And a working smbusers:
# Unix_name = SMB_name1 SMB_name2 ... root = administrator MYDOMAIN\administrator nobody = guest pcguest smbguest
Cups print server
Starting CUPS printing system: cupsd: Child exited with status 98!
- \\
And the logs (Template:/var/log/cups/error log) show:
E [date:hour...] StartListening: Unable to bind socket for address 0.0.0.0:631 - Address already in use.
- ...Or something like this.
- \\
With a correct "cupsd.conf file" (Tested version 1.1.21-0.rc1.7mdk, on Mandrake 10.1 - Now Mandriva), it works; All we need is to remove references to Template:127.0.0.1 or Template:Localhost from the file, as well as correctly unsetting the Template:Listen directive:
LogLevel info TempDir /var/spool/cups/tmp # No 'Listen' directive ! Port 631 BrowseAddress @LOCAL BrowseDeny All BrowseAllow @LOCAL BrowseOrder deny,allow <Location /> Order Deny,Allow Deny From All Allow From @LOCAL </Location> <Location /admin> AuthType Basic AuthClass System Order Deny,Allow Deny From All Allow From YOUR_NETWORK_ADDRESS/YOUR_NETMASK # Example: 172.16.0.0/24 # Or Allow From @LOCAL </Location>
- \\
Then you'll need to modify the Template:/etc/init.d/cups script, to comment any section referring to Template:127.0.0.1 lookup and configuration. This section exists at least on Mandrake 10.1, and is pretty long (Lines 35 to 55 and/or 79), and additionnaly four "Template:Else...if" lines must be commented far below (Lines 161 to 164) !
- \\
Remember to stop any Cupsd running in the host server, or to start it via a wrapper Template:/etc/init.d/v cups script:
#!/bin/sh # chkconfig: 2345 15 60 # description: Wrapper to start cups bound to a single IP USR_LIB_VSERVER=/usr/lib/util-vserver exec $USR_LIB_VSERVER/vsysvwrapper cups $*
- \\
Do not forget to give a password to the root user, if you want to ba able to manage your printers from the web interface (http://yourcupsvserver:631)!
# passwd root ...
- \\
If you use Mandriva 10.1 (And maybe some other distros), you’ll need to add the printers drivers for Cups, and reload it:
# urpmi --root /vservers/yourcupsvserver/ cups-drivers # /etc/init.d/cups reload
- \\
…It added 67 Mb of packages for me.
- \\
Then use Template:/etc/init.d/v cups (re)start to launch Cups on the host server.
- You will now be able to make Cupsd start in the vserver , but more tweaking on the ACLs may be necessary to avoid authentification problems...
Bind9 on Debian GNU/Linux Woody (3.0) and Sarge (3.1)
- \\
The debian way is to build** your own package without CAPs:
- \\
su - cd /usr/src apt-get build-dep bind9 apt-get source bind9 cd bind9-x.x.x vi debian/rules
- \\
Insert the following line after "./configure --prefix=/usr \":
- \\
--disable-linux-caps \
- \\
On a NPTL-enabled system you alse have to replace \\
--enable-threads \
- with \\
--disable-threads \
- or bind might refuse to run with an other user than root.
- \\
Save the file and go ahead with compiling/installing:
- \\
dpkg-buildpackage dpkg -i ../bind9-x.x.x.deb echo "bind9 hold" | dpkg --set-selections
- \\
The last line is to set the package "on hold", so it is not touched by the update process. you have to take care of security holes by yourself now!
- \\
The Xs in "bind9-x.x.x" denote the version number of bind9.
- \\
- Alternatively you can allow the CAP_SYS_RESOURCE for that V-Server.
The best way would be to fix bind, which is somehow broken when it comes to capabilities. Daniel Hokka Zakrisson repaired it. His patch is to be found here:
bind-9.3.2-caps-when-available.patch So, if you recompile, it would be the cleanest way to apply that patch. Thanks Daniel!
It would be also nice, if someone submits that patch to the bind people or maybe to your distribution's package maintainers in the first step.
Get my vserver-guest-ready Debian bind9 package for Debian Sid guests. Feedback welcome: aj@net-lab.net
Postfix 2.1.5 (Debian Sarge)
Zimbra Mail
xine
"xine --verbose" shows this.
ERROR: Could not determine network interfaces, you must use a interfaces config lineThis happens if you have the xineplug_inp_smb.so plugin. Delete it and everything is fine.
127.0.0.1 issues
- dev lo
- ip 127.0.0.1
- mask 255.0.0.0
- name lo
now interface "1" is the default created interface by the vserver build script with a local adress like 192.168.1.2 and interface "0" is the loopback. I can now telnet on 127.0.0.1 and it sees that im connecting to 127.0.0.1 from 127.0.0.1
Compiling nagios-1.4 within a vserver requires this, otherwise it hangs during the configure with "checking for ICMP ping syntax..."
/!\ BIG FAT WARNING: DON'T DO THIS: THE VSERVER WILL HAVE ACCESS TO THE 127.0.0.1 OF THE HOST (quoting Bertl from irc)
