OpenVZ Forum - RDF feed
type: channel
items: *SOLVED* SSH with single ip address?
items: Re: SSH with single ip address?

*SOLVED* SSH with single ip address?
type: item
description: Hello everyone, I was wondering if it is possible to run a single ssh server for both the host and the virtual machine, since I only have one public ip address (and unable to get more). Right now I'm using jail but that definately has it's limits and I'd like to use OpenVZ, but I can't find a possibility to let the user login to the virtual system directly (with jail I just set the shell to /usr/bin/jail) Thanks in advance.
creator: Rick
date: 2006-10-17T12:23:52-00:00

Re: SSH with single ip address?
type: item
description: It seems that DNAT should help you. Look at second part of this article: http://wiki.openvz.org/Using_NAT_for_VE_with_private_IPs. HTH, vas.
creator: Vasily Tarasov
date: 2006-10-17T12:30:33-00:00

Re: SSH with single ip address?
type: item
description: Correct me if I'm wrong but that would only allow me to forward the port to the virtual server right? So I'd still be using 2 ssh servers on different ports while I want to let it go to the virtual server per user.
creator: Rick
date: 2006-10-17T12:41:26-00:00

Re: SSH with single ip address?
type: item
description: Yes you're right. Only port redirect. You should run ssh server in every VE... I don't know over ways...
creator: Vasily Tarasov
date: 2006-10-17T12:46:17-00:00

Re: SSH with single ip address?
type: item
description: Ok, thanks for the help anyway I'm gonna try and hack it in myself [edit] I'm unable to find a safe method of hacking it in, I don't think it's possible without changing too much in either sshd or the OpenVZ system.
creator: Rick
date: 2006-10-17T13:04:03-00:00

Re: SSH with single ip address?
type: item
description: Sorry, didn't get what you mean by the text after [Edit]. DNAT doesn't require any hacking. But I've got another idea... what if some one specifies 'vzctl enter VEID' as a shell in /etc/passwd in the host? In this case it will be possible IMHO to have remove VE root via host ssh. Same can be done for other users, but it is not that convinient way, since passwords won't be changeable from VE.
creator: dev
date: 2006-10-19T09:10:11-00:00

Re: SSH with single ip address?
type: item
description: The DNAT part isn't any problem, but getting it working so people can logging directly is. However, I have tried what you are saying but it gives me an error: error on vz_env_create_ioctl(VE_TEST): Operation not permitted I've tried to find out what the cause is and it seems that it's about not being able to get read/write right on /dev/vzctl, but the user does have those rights. So I'm getting a dead end here.
creator: Rick
date: 2006-10-19T11:36:10-00:00

Re: SSH with single ip address?
type: item
description: Well, you can set sticky bit on /usr/sbin/vzctl, it should help, but be carefull: all non-root users after that wil be able to manage VEs!
creator: Vasily Tarasov
date: 2006-10-19T11:59:43-00:00

Re: SSH with single ip address?
type: item
description: That's what I'm trying to avoid, but that's not even such a bad idea, I think I'll use sudo to do it then. Thanks for the help
creator: Rick
date: 2006-10-19T12:02:22-00:00