Hello everyone, I was wondering if it is possible to run a single ssh server for both the host and the virtual machine, since I only have one public ip address (and unable to get more). Right now I'm using jail but that definately has it's limits and I'd like to use OpenVZ, but I can't find a possibility to let the user login to the virtual system directly (with jail I just set the shell to /usr/bin/jail) Thanks in advance.
It seems that DNAT should help you. Look at second part of this article: http://wiki.openvz.org/Using_NAT_for_VE_with_private_IPs. HTH, vas.
Correct me if I'm wrong but that would only allow me to forward the port to the virtual server right? So I'd still be using 2 ssh servers on different ports while I want to let it go to the virtual server per user.
Yes you're right. Only port redirect. You should run ssh server in every VE... I don't know over ways...
Ok, thanks for the help anyway I'm gonna try and hack it in myself [edit] I'm unable to find a safe method of hacking it in, I don't think it's possible without changing too much in either sshd or the OpenVZ system.
Sorry, didn't get what you mean by the text after [Edit]. DNAT doesn't require any hacking. But I've got another idea... what if some one specifies 'vzctl enter VEID' as a shell in /etc/passwd in the host? In this case it will be possible IMHO to have remove VE root via host ssh. Same can be done for other users, but it is not that convinient way, since passwords won't be changeable from VE.
The DNAT part isn't any problem, but getting it working so people can logging directly is. However, I have tried what you are saying but it gives me an error: error on vz_env_create_ioctl(VE_TEST): Operation not permitted I've tried to find out what the cause is and it seems that it's about not being able to get read/write right on /dev/vzctl, but the user does have those rights. So I'm getting a dead end here.
Well, you can set sticky bit on /usr/sbin/vzctl, it should help, but be carefull: all non-root users after that wil be able to manage VEs!
That's what I'm trying to avoid, but that's not even such a bad idea, I think I'll use sudo to do it then. Thanks for the help