OpenVZ Forum


Home » General » Support » Is it practical/possible to have openvz with mutiple VEs on a single IP?
Is it practical/possible to have openvz with mutiple VEs on a single IP? [message #22671] Thu, 01 November 2007 11:29 Go to next message
JimL is currently offline  JimL
Messages: 116
Registered: February 2007
Senior Member
The situation is that I'm going to have a system installed where I have only one or two IP addresses but would like to host 6 or so different domains. I can use the tried and true method of using virtual hosts in Apache and proftpd but I'd like to implement this using openvz. Is this possible/practical? If so, how?

Thanks,
Jim.
Re: Is it practical/possible to have openvz with mutiple VEs on a single IP? [message #22674 is a reply to message #22671] Thu, 01 November 2007 11:44 Go to previous messageGo to next message
Bodysplit is currently offline  Bodysplit
Messages: 20
Registered: July 2007
Junior Member
Hi JimL,

you can always go and do good old NATing of several different hosts to virtual internal IPs (eg 192.168.x.x). Keep in mind that this will only work on a per-service level. Say you might want to give your mailserver one VZ and your Apache another one.

This would simply be added security.

If you want to run several apache-instances on different hosts, you would need to run a proxy server on one VE or the host (not recommended - security). The proxy could go and interpret the clients DNS wanted and hand out the wanted data from another VZ. The problem with this situation to me is, how could the users of different servers edit their webspace say with FTP? We could only redirect to one FTP service which needs access to all VEs hosting areas => the FTP would need to be run on the host.

All in all, I personally can not think of a good hosting for several domains with different VEs. Although, service seperation might be the option that already suits you.


--
This doesn't look comfortable...
Re: Is it practical/possible to have openvz with mutiple VEs on a single IP? [message #22677 is a reply to message #22671] Thu, 01 November 2007 12:31 Go to previous messageGo to next message
tpso
Messages: 19
Registered: September 2006
Location: Denmark
Junior Member
Hi Jim

I run a couple of VZ-host each running a small number of domains, in different VE's.

So I believe it is both practical and possible.

I use one VE to run the apache that listens to the external port, and then uses virtual-domains and mod_proxy to forward each domain into it's own VE.

The benefits are many:
- Each domain can run different kind of web-software (php, typo3, tomcat, xplanner, twiki ect) and it is much simpler to administrate when it is running in different VE's.
- IT is possible to update one site with a new version without the risk of corrupting the others.
- It is possible to give external users access to a single domain. For that purpose it setup nat for ssh, so eg external-ip:6022 maps to the ssh-port in one VE.
- easy backup and restore of a single domian via vzdump.
- ...

So go on - I think you will be happy once you have it up and running.

regards
Thomas
Re: Is it practical/possible to have openvz with mutiple VEs on a single IP? [message #22679 is a reply to message #22677] Thu, 01 November 2007 13:13 Go to previous messageGo to next message
JimL is currently offline  JimL
Messages: 116
Registered: February 2007
Senior Member
tpso wrote on Thu, 01 November 2007 07:31

Hi Jim

I run a couple of VZ-host each running a small number of domains, in different VE's.

So I believe it is both practical and possible.

I use one VE to run the apache that listens to the external port, and then uses virtual-domains and mod_proxy to forward each domain into it's own VE.

The benefits are many:
- Each domain can run different kind of web-software (php, typo3, tomcat, xplanner, twiki ect) and it is much simpler to administrate when it is running in different VE's.
- IT is possible to update one site with a new version without the risk of corrupting the others.
- It is possible to give external users access to a single domain. For that purpose it setup nat for ssh, so eg external-ip:6022 maps to the ssh-port in one VE.
- easy backup and restore of a single domian via vzdump.
- ...

So go on - I think you will be happy once you have it up and running.

regards
Thomas

Hi Thomas,
Thanks for the encouragement. I can muddle through getting mod_proxy to redirect the http requests, but is there a way to redirect "ssh www.foobar.com" to xxx.xxx.xxx.xxx:6062 as in your example? Or would the user have to ssh -p 6022?

There are large holes in my networking knowledge.

THanks,
Jim.
Re: Is it practical/possible to have openvz with mutiple VEs on a single IP? [message #22680 is a reply to message #22679] Thu, 01 November 2007 13:15 Go to previous messageGo to next message
Bodysplit is currently offline  Bodysplit
Messages: 20
Registered: July 2007
Junior Member
there is no hostname function in the SSH protocol. The user would have to use -p port option.

--
This doesn't look comfortable...
Re: Is it practical/possible to have openvz with mutiple VEs on a single IP? [message #22682 is a reply to message #22680] Thu, 01 November 2007 13:25 Go to previous messageGo to next message
JimL is currently offline  JimL
Messages: 116
Registered: February 2007
Senior Member
How do the ISPs do it? I have a couple of sites hosted by web hosting companies that let me ssh to my domain. These sites are on shared IP addresses, so I know that something is keying off of the domain name to get me to the right place. I don't have to specify a port.

Jim.
Re: Is it practical/possible to have openvz with mutiple VEs on a single IP? [message #22685 is a reply to message #22682] Thu, 01 November 2007 13:57 Go to previous messageGo to next message
Bodysplit is currently offline  Bodysplit
Messages: 20
Registered: July 2007
Junior Member
chroot'ing every user to a VE is possible when you serve SSH access from the host.

It's a problem if you encounter a security flaw in SSH's chroot and one user might get data of another VEs user...


--
This doesn't look comfortable...
Re: Is it practical/possible to have openvz with mutiple VEs on a single IP? [message #22692 is a reply to message #22679] Thu, 01 November 2007 15:25 Go to previous messageGo to next message
tpso
Messages: 19
Registered: September 2006
Location: Denmark
Junior Member
Hi Jim

Yes the useres will do ssh -p 6022 or find another way to specify the port number. I think can remember that it is possible to set up in one of the .ssh/ files, but i'm not sure.

Regards
Thomas
Re: Is it practical/possible to have openvz with mutiple VEs on a single IP? [message #27810 is a reply to message #22692] Thu, 28 February 2008 09:51 Go to previous message
DiSH is currently offline  DiSH
Messages: 5
Registered: February 2008
Junior Member
Hi everyone!

AFAIK, Virtuozzo for Linux can do this thing, but I couldn't find any info about the technology.

I'm trying to separate services and domains, but wonder how...

Maybe, anyone can know, how to implement that Virtuozzo technology using open-source tools? Or maybe I need Cisco router with some features?
Previous Topic: kernel: unregister_netdevice:
Next Topic: openvz with hsphere 3.1 beta 2 - help
Goto Forum:
  


Current Time: Thu May 09 21:46:14 GMT 2024

Total time taken to generate the page: 0.01529 seconds