Difference between revisions of "Installation on Debian"

From Linux-VServer

Jump to: navigation, search
m (Reverted edits by PearlieHyde1974 (talk) to last revision by Glenn)
(Systemd on guests)
 
(29 intermediate revisions by 2 users not shown)
Line 1: Line 1:
'''Note:''' Debian 6.0 is the final version to include precompiled Linux-Vserver kernels. In newer versions (including Debian Testing), you'll have to compile the kernel yourself or [http://linux-vserver.org/Frequently_Asked_Questions#Were_can_I_get_newer_versions_of_VServer_as_ready_made_packages_for_Debian.3F use a pre-packaged kernel]. [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=574529]
+
Debian 6.0 'Squeeze' was the final version to include precompiled Linux-Vserver kernels [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=574529]. In newer versions (including Debian Testing), you'll have to compile the kernel yourself or use a pre-packaged kernel. Information on alternative Debian repositories with more functional packages is [[Frequently_Asked_Questions#Were_can_I_get_newer_versions_of_VServer_as_ready_made_packages_for_Debian.3F | contained in this section of the FAQ]]. If you need to compile your own kernel, you need to apply the vserver-version.patch. See the [http://linux-vserver.org/Welcome_to_Linux-VServer.org]
  
This guide is written against Debian Etch (4.0) and works on Lenny (5.0) as well. Both releases include kernel '''linux-image-vserver-686''', so no manual patching is needed. Hence, Installation on Debian Etch/Lenny is pretty easy and straightforward.
+
Here is a list of kernels and util-vserver in Debian's own repository and the actively maintained repo.psand.net repository:
  
If you need to compile your own kernel, you need to apply the vserver-version.patch. [http://www.kwu.hu/vserver.txt Details at 2007/May/04]
 
  
In lenny and etch the tools are for the 2.2 version of vservers, you can find on beng repository packages for the 2.3 version of util-vserver until it is integrated in debian. See
+
{|class="wikitablenowrap"
* [[util-vserver:Devdebianpackage]] - Info about debian v2.3 package from the community
+
!Debian release
* explanation on how to use this repository from: http://kernels.bristolwireless.net/  How to use the Debian Repository
+
!repo.psand.net Kernel Version
 +
!repo.psand.net Util-VServer Version
 +
!Debian Kernel version
 +
!Debian Util-VServer version
 +
|-
 +
| Debian 8.0 Jessie
 +
| 3.14 3.18
 +
| 0.30.216-pre3120
 +
| x
 +
| 0.30.216-pre3054-1
 +
|-
 +
| Debian 7.0 Wheezy
 +
| 3.2 3.4 3.10 3.14 3.18
 +
| 0.30.216-pre3120
 +
| x
 +
| x
 +
|-
 +
| Debian 6.0 Squeeze
 +
| 2.6.36 2.6.38 3.0 3.2
 +
| 0.30.216-pre3038
 +
| 2.6.32
 +
| 0.30.216-pre2864
 +
|-
 +
| Debian 5.0 Lenny
 +
| 2.6.36
 +
| 0.30.216-pre2925
 +
| 2.6.26+17
 +
| 2.3.0.35
 +
|-
 +
| Debian 4.0 Etch
 +
| x
 +
| x
 +
| 2.6.18+6
 +
| 2.0.2.2-rc9
 +
|-
 +
|}
  
  
== Packages installation ==
 
The packages required by Linux-VServer are:
 
* '''linux-image-vserver-686''' - This is the current kernel, use '''linux-image-vserver-amd64''' on 64-bit systems, you can still create 32-bit guests
 
* '''util-vserver''' - These are the utilities used to administer the guests
 
* '''ssh''' - This is probably already installed, but just in case it isn't
 
  
All the packages you need can be obtained via
+
=== Building util-vserver Packages ===
<pre>aptitude install linux-image-vserver-686 util-vserver ssh</pre>
+
so run this as ''root'' and reboot.
+
To check out wherever everything went fine you may run
+
<pre>uname -r</pre>
+
and check that kernel version contains '''vserver''', e.g. '''2.6.18-4-vserver-686'''. That's it.
+
  
Now that the host system is ready, you can proceed with [[Building Guest Systems|building guests]].
+
Download the source, unpack it, enter the directory you just unpacked and run:
  
=== Install util-vserver by source ===
+
dpkg-buildpackage -rfakeroot -us -uc
Occasionally, Debian's util-vserver package can be too old. So, we'll need to compile from [http://people.linux-vserver.org/~dhozac/t/uv-testing/ source].
+
  
First, install the required packages for util-vserver to compile.
+
You may need to satisfy some dependencies for this to work.
<pre>apt-get install vlan dietlibc-dev pkg-config libnss3-dev</pre>
+
  
Then, we configure util-vserver
 
<pre>./configure --prefix=/usr --enable-release --mandir=/usr/share/man \
 
--infodir=/usr/share/info --sysconfdir=/etc --enable-dietlibc \
 
--localstatedir=/var --with-vrootdir=/home</pre>
 
Note: You should change ''--with-vrootdir'' accordingly
 
  
Finally, we run make to finalise the installation
+
== Distro Specific Notes ==
<pre>make && make install install-distribution</pre>
+
  
Running ''vserver-info'' will show you that the proper util-vserver is installed. :)
+
=== Jessie ===
  
Debian likes to be funny, so we need to enable the following,
+
==== Systemd on guests ====
* echo /usr/lib/util-vserver/vshelper >| /proc/sys/kernel/vshelper
+
* echo kernel.vshelper = /usr/lib/util-vserver/vshelper >> /etc/sysctl.conf
+
* update-rc.d vprocunhide defaults
+
* update-rc.d vservers-default defaults
+
  
== Versions ==
+
For building new guests, or upgrading old ones, systemd needs to be prevented from installing.
  
Debian already contains vservers kernels, so no manual patching and compiling is needed.  
+
* To make sure systemd is not present after upgrade see [http://without-systemd.org/wiki/index.php/How_to_remove_systemd_from_a_Debian_jessie/sid_installation]
 +
* To install a guest without systemd present a working example is:
  
{|class="wikitablenowrap"
+
vserver jessie64 build  -n jessie64 -m debootstrap --i-know-its-there \
!Debian release
+
--context 44000 --hostname jessie64.whatever.com -- \
!Kernel version
+
-d jessie -- --arch=amd64 --include=sysvinit-core,sysvinit,sysvinit-utils \
!VServer version
+
--exclude=systemd;
|-
+
| Squeeze
+
| 2.6.32
+
| 2.3.0.36.29.6
+
|-
+
| Lenny
+
| 2.6.26+17
+
| 2.3.0.35
+
|-
+
| Etch
+
| 2.6.18+6
+
| 2.0.2.2-rc9
+
  
|-
+
==== Systemd on hosts ====
|}
+
  
The Vserver versions given above are not completely pure, they have additional patches to fix various issues.
+
Systemd must also be removed from hosts. With it present the host will loose it's /proc /sys and /dev on host starts or stops. See advice on how to remove it at [http://without-systemd.org/wiki/index.php/How_to_remove_systemd_from_a_Debian_jessie/sid_installation].
  
Information on alternative Debian repositories with more functional packages is [[Frequently_Asked_Questions#Were_can_I_get_newer_versions_of_VServer_as_ready_made_packages_for_Debian.3F | contained in this section of the FAQ]].
+
=== Wheezy ===
  
== Issues with Squeeze's 2.6.32 Kernel and Util-vserver ==
+
There are some issues with Wheezy's 3.2.55 Kernel and Util-vserver.
 +
 
 +
* Util-vserver 0.30.216-pre3060-1 from the APT repository (repo.psand.net) moves vshelper to a new location.  If you attempt to manage guests (restart, start, etc) without restarting the util-vserver service, vserver will display "vshelper functionality" errors.  The util-vserver service will notify the kernel of the new location when the service is restarted.  However, restarting util-vserver will also restart all of your guests.  You can immediately notify the kernel of the new vshelper location (without restarting util-vserver or your guests) by running the following command:
 +
echo /usr/lib/x86_64-linux-gnu/util-vserver/vshelper >| /proc/sys/kernel/vshelper
 +
 
 +
=== Squeeze ===
 +
 
 +
There is one small issues with Squeeze's own Util-vserver:
  
 
* Util-vserver shipping with debian, does not have the symbolic link for squeeze, fixed by  
 
* Util-vserver shipping with debian, does not have the symbolic link for squeeze, fixed by  
 
   ln -s debian /usr/lib/util-vserver/distributions/squeeze
 
   ln -s debian /usr/lib/util-vserver/distributions/squeeze
  
== Issues with Lenny's 2.6.26 Kernel and Util-vserver ==
+
=== Lenny ===
 +
 
 +
There are many issues with Lenny's own 2.6.26 Kernel and Util-vserver.
 +
 
 +
In lenny the tools are for the 2.2 version of vservers, you can find on beng repository packages for the 2.3 version of util-vserver until it is integrated in debian. See
 +
* [[util-vserver:Devdebianpackage]] - Info about debian v2.3 package from the community
 +
* explanation on how to use this repository from: http://repo.psand.net/info  How to use the Debian Repository
  
=== Hard CPU scheduling ===
+
==== Hard CPU scheduling ====
  
 
This will not work in the Debian 'Lenny' Kernel, the patch used simply does not contain any of this functionality.
 
This will not work in the Debian 'Lenny' Kernel, the patch used simply does not contain any of this functionality.
  
=== Problems due to Xattrs ===
+
==== Problems due to Xattrs ====
  
 
There are two sets of issues within the Lenny kernel caused by the change in value of the Xattrs (extended attributes) applied to file in Vserver setups. The patch used in Debian Lenny uses Xattr flags which are set in positions which differ from the flags set by Debian kernels as well as most of the mainline Vserver patches. This result is that Xattrs of files in a non lenny system appear to have completely different flags in Lenny and vice versa. Since these flags are crucial to vserver hashification and chroot security, they can have devastating effects on Vserver guests and on host system security. If you have recently moved to or away from the stock Lenny Vserver kernel, have look at the symptoms below to see if any match your experiences, and apply the fixes/use another kernel as you see fit.
 
There are two sets of issues within the Lenny kernel caused by the change in value of the Xattrs (extended attributes) applied to file in Vserver setups. The patch used in Debian Lenny uses Xattr flags which are set in positions which differ from the flags set by Debian kernels as well as most of the mainline Vserver patches. This result is that Xattrs of files in a non lenny system appear to have completely different flags in Lenny and vice versa. Since these flags are crucial to vserver hashification and chroot security, they can have devastating effects on Vserver guests and on host system security. If you have recently moved to or away from the stock Lenny Vserver kernel, have look at the symptoms below to see if any match your experiences, and apply the fixes/use another kernel as you see fit.
Line 93: Line 106:
 
As of writing these issue has not been corrected within the Debian archive.  These fixes must be applied whenever moving vserver guest '''from''' or '''to''' the Debian 'Lenny's vserver kernel. For more details and a more concise explanation see [http://irc.13thfloor.at/LOG/2009-05/LOG_2009-05-12.txt Bertls IRC explanation ].
 
As of writing these issue has not been corrected within the Debian archive.  These fixes must be applied whenever moving vserver guest '''from''' or '''to''' the Debian 'Lenny's vserver kernel. For more details and a more concise explanation see [http://irc.13thfloor.at/LOG/2009-05/LOG_2009-05-12.txt Bertls IRC explanation ].
  
==== Chroot Security Problems ====
+
===== Chroot Security Problems =====
  
 
Linux-Vserver uses file Xattrs to protect guest superusers from being able to view files above their root, preventing access to host file. This creates issues for anyone who:
 
Linux-Vserver uses file Xattrs to protect guest superusers from being able to view files above their root, preventing access to host file. This creates issues for anyone who:
Line 107: Line 120:
 
To fix the barrier flags for a current kernel, see [[Secure_chroot_Barrier#Solution:_Secure_Barrier | these instructions]]. Note that on some setups a barrier flags will appear on all directories under the guest hierarchy, and need to be unset in order to allow the servers to run. Use showattr to reveal the state of play for your guests and fix appropriately.
 
To fix the barrier flags for a current kernel, see [[Secure_chroot_Barrier#Solution:_Secure_Barrier | these instructions]]. Note that on some setups a barrier flags will appear on all directories under the guest hierarchy, and need to be unset in order to allow the servers to run. Use showattr to reveal the state of play for your guests and fix appropriately.
  
==== Unification Problems ====
+
===== Unification Problems =====
  
 
There is a discrepancy between the immutable-unlink flag used for file unification, the process used in vhashify. This creates considerable issues for anyone who:
 
There is a discrepancy between the immutable-unlink flag used for file unification, the process used in vhashify. This creates considerable issues for anyone who:
Line 123: Line 136:
  
  
=== /proc/mounts issue ===
+
==== /proc/mounts issue ====
  
 
The vserver's /proc/mounts let appear the vserver path on the host. lsof (for example) is able to print it.
 
The vserver's /proc/mounts let appear the vserver path on the host. lsof (for example) is able to print it.
  
=== "Ghosts" guests ===
+
==== "Ghosts" guests ====
  
==== Issue ====
+
===== Issue =====
 
Sometimes a guests loose it's name in vserver-stats and is acting like a zombie. It's impossible to restart or kill it. Stopping all the guests with the util-vserver init.d script doesn't solve the issue. vkill --xid $CTX  doesn't either.
 
Sometimes a guests loose it's name in vserver-stats and is acting like a zombie. It's impossible to restart or kill it. Stopping all the guests with the util-vserver init.d script doesn't solve the issue. vkill --xid $CTX  doesn't either.
  
==== Fix ====
+
===== Fix =====
 
   echo 50 > /var/run/vservers/$vserver
 
   echo 50 > /var/run/vservers/$vserver
  
 
Seems to fix the issue
 
Seems to fix the issue
  
== References ==
+
 
 +
 
 +
 
 +
-----------
 +
 
 +
= References =
 
* Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch
 
* Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch
  
 
[[Category:Installation]]
 
[[Category:Installation]]

Latest revision as of 13:52, 28 July 2015

Debian 6.0 'Squeeze' was the final version to include precompiled Linux-Vserver kernels [1]. In newer versions (including Debian Testing), you'll have to compile the kernel yourself or use a pre-packaged kernel. Information on alternative Debian repositories with more functional packages is contained in this section of the FAQ. If you need to compile your own kernel, you need to apply the vserver-version.patch. See the [2]

Here is a list of kernels and util-vserver in Debian's own repository and the actively maintained repo.psand.net repository:


Debian release repo.psand.net Kernel Version repo.psand.net Util-VServer Version Debian Kernel version Debian Util-VServer version
Debian 8.0 Jessie 3.14 3.18 0.30.216-pre3120 x 0.30.216-pre3054-1
Debian 7.0 Wheezy 3.2 3.4 3.10 3.14 3.18 0.30.216-pre3120 x x
Debian 6.0 Squeeze 2.6.36 2.6.38 3.0 3.2 0.30.216-pre3038 2.6.32 0.30.216-pre2864
Debian 5.0 Lenny 2.6.36 0.30.216-pre2925 2.6.26+17 2.3.0.35
Debian 4.0 Etch x x 2.6.18+6 2.0.2.2-rc9


Contents

[edit] Building util-vserver Packages

Download the source, unpack it, enter the directory you just unpacked and run:

dpkg-buildpackage -rfakeroot -us -uc

You may need to satisfy some dependencies for this to work.


[edit] Distro Specific Notes

[edit] Jessie

[edit] Systemd on guests

For building new guests, or upgrading old ones, systemd needs to be prevented from installing.

  • To make sure systemd is not present after upgrade see [3]
  • To install a guest without systemd present a working example is:
vserver jessie64 build   -n jessie64 -m debootstrap --i-know-its-there \
--context 44000 --hostname jessie64.whatever.com -- \
-d jessie -- --arch=amd64 --include=sysvinit-core,sysvinit,sysvinit-utils \
--exclude=systemd;

[edit] Systemd on hosts

Systemd must also be removed from hosts. With it present the host will loose it's /proc /sys and /dev on host starts or stops. See advice on how to remove it at [4].

[edit] Wheezy

There are some issues with Wheezy's 3.2.55 Kernel and Util-vserver.

  • Util-vserver 0.30.216-pre3060-1 from the APT repository (repo.psand.net) moves vshelper to a new location. If you attempt to manage guests (restart, start, etc) without restarting the util-vserver service, vserver will display "vshelper functionality" errors. The util-vserver service will notify the kernel of the new location when the service is restarted. However, restarting util-vserver will also restart all of your guests. You can immediately notify the kernel of the new vshelper location (without restarting util-vserver or your guests) by running the following command:
echo /usr/lib/x86_64-linux-gnu/util-vserver/vshelper >| /proc/sys/kernel/vshelper

[edit] Squeeze

There is one small issues with Squeeze's own Util-vserver:

  • Util-vserver shipping with debian, does not have the symbolic link for squeeze, fixed by
 ln -s debian /usr/lib/util-vserver/distributions/squeeze

[edit] Lenny

There are many issues with Lenny's own 2.6.26 Kernel and Util-vserver.

In lenny the tools are for the 2.2 version of vservers, you can find on beng repository packages for the 2.3 version of util-vserver until it is integrated in debian. See

[edit] Hard CPU scheduling

This will not work in the Debian 'Lenny' Kernel, the patch used simply does not contain any of this functionality.

[edit] Problems due to Xattrs

There are two sets of issues within the Lenny kernel caused by the change in value of the Xattrs (extended attributes) applied to file in Vserver setups. The patch used in Debian Lenny uses Xattr flags which are set in positions which differ from the flags set by Debian kernels as well as most of the mainline Vserver patches. This result is that Xattrs of files in a non lenny system appear to have completely different flags in Lenny and vice versa. Since these flags are crucial to vserver hashification and chroot security, they can have devastating effects on Vserver guests and on host system security. If you have recently moved to or away from the stock Lenny Vserver kernel, have look at the symptoms below to see if any match your experiences, and apply the fixes/use another kernel as you see fit.

As of writing these issue has not been corrected within the Debian archive. These fixes must be applied whenever moving vserver guest from or to the Debian 'Lenny's vserver kernel. For more details and a more concise explanation see Bertls IRC explanation .

[edit] Chroot Security Problems

Linux-Vserver uses file Xattrs to protect guest superusers from being able to view files above their root, preventing access to host file. This creates issues for anyone who:

  • has created a guest with a Debian 2.6.26-*-vserver kernel and wishes to use it with another kernel.
  • has created a guest with a different kernel and wishes to use it on a Debian 2.6.26-*-vserver kernel based host.

In effect, the barrier normally in place for guest servers is not recognised by the kernel (the chroot problem) in the situation above and/or immutable links will not function correctly (the unification problem)failing to break when overwritten) in a unified guest setup. Symptoms suffered may include:

  • the possibility of vserver guest processes escaping their chroots and accessing other parts of the filesystem
  • guest not starting

To fix the barrier flags for a current kernel, see these instructions. Note that on some setups a barrier flags will appear on all directories under the guest hierarchy, and need to be unset in order to allow the servers to run. Use showattr to reveal the state of play for your guests and fix appropriately.

[edit] Unification Problems

There is a discrepancy between the immutable-unlink flag used for file unification, the process used in vhashify. This creates considerable issues for anyone who:

  • has unified guests with a Debian 2.6.26-*-vserver kernel and wishes to use them with another kernel.
  • has unified guests with a different kernel and wishes to then it on a Debian 2.6.26-*-vserver kernel based host.

Symptoms suffered may include:

  • file that cannot be deleted
  • any process involving the writing of files in guests not working
  • files not being unlinked on write

To fix the problem each file must be unlinked then the unification re-applied, or one could try this script submitted to bugs.debian.org.


[edit] /proc/mounts issue

The vserver's /proc/mounts let appear the vserver path on the host. lsof (for example) is able to print it.

[edit] "Ghosts" guests

[edit] Issue

Sometimes a guests loose it's name in vserver-stats and is acting like a zombie. It's impossible to restart or kill it. Stopping all the guests with the util-vserver init.d script doesn't solve the issue. vkill --xid $CTX doesn't either.

[edit] Fix
 echo 50 > /var/run/vservers/$vserver

Seems to fix the issue




[edit] References

Personal tools