Hi, I am reading RHEL documents and found that they do not recommend to use guest agents in production servers: Quote: Note that it is only safe to rely on the QEMU guest agent when run by trusted guests. An untrusted guest may maliciously ignore or abuse the guest agent protocol, and although built-in safeguards exist to prevent a denial of service attack on the host, the host requires guest co-operation for operations to run as expected. I wonder if any changes regarding this issue were made in OpenVZ 7?
Guest Agent's protocol is one-direction - from host to guest. It is a server inside guest, servicing requests from the host node. In OpenVZ it is used for advanced guest configuration (network settings, user password, some performance statistics). If malicious user wants to deny such advanced configuration or stats - he can do it. But unlikely he'll be able to cause the host DoS.
Thanks