OpenVZ Forum


Home » Mailing lists » Users » a newbie question
a newbie question [message #46808] Sun, 17 June 2012 10:25 Go to next message
cheetah is currently offline  cheetah
Messages: 7
Registered: June 2012
Junior Member
From: *parallels.com
Hi guys,

I am a newbie to openvz and preparing to deploy it in my production
environment to give each user a container. I have the following concerns
now.

1. Can user load kernel modules in the guest container without influencing
the host kernel or other container's kernel? As far as I understand, all
the containers share the same kernel of the host. So I am wondering if this
is possible?

2. Or how is the container's security isolation? Can I give user root
access in the container? Is there any hack that he/she can use root in the
container to attack the host or other containers?

3. Does openvz kernel support kvm?

4. What is recommended distro of Linux to install openvz? I am now using
CentOS 6.2. How about Debian?

Thanks a lot for answering my stupid questions.

Regards,
Peter
Re: a newbie question [message #46810 is a reply to message #46808] Sun, 17 June 2012 10:56 Go to previous messageGo to next message
Martin Dobrev is currently offline  Martin Dobrev
Messages: 14
Registered: November 2006
Junior Member
From: *parallels.com
Martin Dobrev

Sent from iPhonespam SPAMSPAM 4

On 17.06.2012, at 13:25, cheetah <xuwh06@gmail.com> wrote:

> Hi guys,
>

Hi Peter,

> I am a newbie to openvz and preparing to deploy it in my production environment to give each user a container. I have the following concerns now.
>
> 1. Can user load kernel modules in the guest container without influencing the host kernel or other container's kernel? As far as I understand, all the containers share the same kernel of the host. So I am wondering if this is possible?
>

Some modules can be shared from the host sytem to the containers. More info in the vzctl man page.

> 2. Or how is the container's security isolation? Can I give user root access in the container? Is there any hack that he/she can use root in the container to attack the host or other containers?
>
It's impossible to gain host system access using a kernel bug as far as I know. Some kernel exploits are still able to crash the hole system. Giving root in the container will be considered as secure as giving root on physical server.
> 3. Does openvz kernel support kvm?
>
It's possible to have Xen and KVM compiled in the OVZ kernel but you'll need to compile it yourself.
> 4. What is recommended distro of Linux to install openvz? I am now using CentOS 6.2. How about Debian?
>
Mainstream kernel development follows the RHEL kernel branches, so best for you will be CentOS. I have some production systems on it too.
> Thanks a lot for answering my stupid questions.
>
I hope my info helps.
> Regards,
> Peter
P.S. There is no need to write to the devel list directly for user questions.
Re: a newbie question [message #46812 is a reply to message #46810] Sun, 17 June 2012 11:10 Go to previous messageGo to next message
cheetah is currently offline  cheetah
Messages: 7
Registered: June 2012
Junior Member
From: *parallels.com
Thanks a lot for the info, Martin.

Nice to know Openvz kernel is based on RHEL6. I am wondering how fast it is
released after a new release of RHEL?

Thanks.
Peter

On Sun, Jun 17, 2012 at 6:56 PM, Martin Dobrev <martin@dobrev.eu> wrote:

>
>
> Martin Dobrev
>
> Sent from iPhonespam SPAMSPAM 4
>
> On 17.06.2012, at 13:25, cheetah <xuwh06@gmail.com> wrote:
>
> > Hi guys,
> >
>
> Hi Peter,
>
> > I am a newbie to openvz and preparing to deploy it in my production
> environment to give each user a container. I have the following concerns
> now.
> >
> > 1. Can user load kernel modules in the guest container without
> influencing the host kernel or other container's kernel? As far as I
> understand, all the containers share the same kernel of the host. So I am
> wondering if this is possible?
> >
>
> Some modules can be shared from the host sytem to the containers. More
> info in the vzctl man page.
>
> > 2. Or how is the container's security isolation? Can I give user root
> access in the container? Is there any hack that he/she can use root in the
> container to attack the host or other containers?
> >
> It's impossible to gain host system access using a kernel bug as far as I
> know. Some kernel exploits are still able to crash the hole system. Giving
> root in the container will be considered as secure as giving root on
> physical server.
> > 3. Does openvz kernel support kvm?
> >
> It's possible to have Xen and KVM compiled in the OVZ kernel but you'll
> need to compile it yourself.
> > 4. What is recommended distro of Linux to install openvz? I am now using
> CentOS 6.2. How about Debian?
> >
> Mainstream kernel development follows the RHEL kernel branches, so best
> for you will be CentOS. I have some production systems on it too.
> > Thanks a lot for answering my stupid questions.
> >
> I hope my info helps.
> > Regards,
> > Peter
> P.S. There is no need to write to the devel list directly for user
> questions.
Re: a newbie question [message #46813 is a reply to message #46812] Sun, 17 June 2012 11:20 Go to previous messageGo to next message
Christian Blaich is currently offline  Christian Blaich
Messages: 6
Registered: June 2012
Junior Member
From: *parallels.com
Check proxmox, ovz kvm modules already loaded in the Kernel. Easy to handle via console and also via Web. Based on debian. Good howtos!

-----

Mobil verfasst

Am 17.06.2012 um 13:10 schrieb cheetah <xuwh06@gmail.com>:

> Thanks a lot for the info, Martin.
>
> Nice to know Openvz kernel is based on RHEL6. I am wondering how fast it is released after a new release of RHEL?
>
> Thanks.
> Peter
>
> On Sun, Jun 17, 2012 at 6:56 PM, Martin Dobrev <martin@dobrev.eu> wrote:
>
>
> Martin Dobrev
>
> Sent from iPhonespam SPAMSPAM 4
>
> On 17.06.2012, at 13:25, cheetah <xuwh06@gmail.com> wrote:
>
> > Hi guys,
> >
>
> Hi Peter,
>
> > I am a newbie to openvz and preparing to deploy it in my production environment to give each user a container. I have the following concerns now.
> >
> > 1. Can user load kernel modules in the guest container without influencing the host kernel or other container's kernel? As far as I understand, all the containers share the same kernel of the host. So I am wondering if this is possible?
> >
>
> Some modules can be shared from the host sytem to the containers. More info in the vzctl man page.
>
> > 2. Or how is the container's security isolation? Can I give user root access in the container? Is there any hack that he/she can use root in the container to attack the host or other containers?
> >
> It's impossible to gain host system access using a kernel bug as far as I know. Some kernel exploits are still able to crash the hole system. Giving root in the container will be considered as secure as giving root on physical server.
> > 3. Does openvz kernel support kvm?
> >
> It's possible to have Xen and KVM compiled in the OVZ kernel but you'll need to compile it yourself.
> > 4. What is recommended distro of Linux to install openvz? I am now using CentOS 6.2. How about Debian?
> >
> Mainstream kernel development follows the RHEL kernel branches, so best for you will be CentOS. I have some production systems on it too.
> > Thanks a lot for answering my stupid questions.
> >
> I hope my info helps.
> > Regards,
> > Peter
> P.S. There is no need to write to the devel list directly for user questions.
Re: a newbie question [message #46814 is a reply to message #46810] Sun, 17 June 2012 13:03 Go to previous messageGo to next message
LightDot is currently offline  LightDot
Messages: 8
Registered: October 2011
Junior Member
From: *parallels.com
Hello Martin and Peter,

On Sun, Jun 17, 2012 at 12:56 PM, Martin Dobrev <martin@dobrev.eu> wrote:
>
>
> Martin Dobrev
>
> Sent from iPhonespam SPAMSPAM 4
>
> On 17.06.2012, at 13:25, cheetah <xuwh06@gmail.com> wrote:
>
>> Hi guys,
>>
>
> Hi Peter,
>
>> I am a newbie to openvz and preparing to deploy it in my production environment to give each user a container. I have the following concerns now.
>>
>> 1. Can user load kernel modules in the guest container without influencing the host kernel or other container's kernel? As far as I understand, all the containers share the same kernel of the host. So I am wondering if this is possible?
>>
>
> Some modules can be shared from the host sytem to the containers. More info in the vzctl man page.
>

Users can't load modules from within the guest containers. Modules can
be loaded on the hardware node and they will be available to all
containers. Usability depends on the specific module, guest containers
might not be able to use some of them.



>> 2. Or how is the container's security isolation? Can I give user root access in the container? Is there any hack that he/she can use root in the container to attack the host or other containers?
>>
> It's impossible to gain host system access using a kernel bug as far as I know. Some kernel exploits are still able to crash the hole system. Giving root in the container will be considered as secure as giving root on physical server.

I would say giving your customers root access to a container is pretty
safe. In case of kernel exploits or bugs, there might be a certain
risk. For example, recent watchdog kernel bug enabled container users
to reboot the node. In my experience, such bugs are quickly dealt with
and few and far between. I haven't been bitten by any yet.



>> 3. Does openvz kernel support kvm?
>>
> It's possible to have Xen and KVM compiled in the OVZ kernel but you'll need to compile it yourself.

I don't think this is true, perhaps I'm misunderstanding what you're
saying. KVM is a part of the mainline kernel and a part of Red Hat
kernels, I don't think openvz is in any way stripping it out. KVM
should work sam as it works on a regular Red hat kernel, shouldn't it?



>> 4. What is recommended distro of Linux to install openvz? I am now using CentOS 6.2. How about Debian?
>>
> Mainstream kernel development follows the RHEL kernel branches, so best for you will be CentOS. I have some production systems on it too.

I'd recommend CentOS or Scientific Linux 6.x. If you'd like to use
Debian, I'd recommend using Red Hat version of openvz kernel with it
too.



>> Thanks a lot for answering my stupid questions.
>>
> I hope my info helps.
>> Regards,
>> Peter
> P.S. There is no need to write to the devel list directly for user questions.
Regards to all...
Re: a newbie question [message #46817 is a reply to message #46813] Mon, 18 June 2012 09:41 Go to previous message
Aleksandar Ivanisevic is currently offline  Aleksandar Ivanisevic
Messages: 34
Registered: April 2011
Member
From: *parallels.com
Christian Blaich <christian@blaich.eu>
writes:

> Check proxmox, ovz kvm modules already loaded in the Kernel. Easy to
> handle via console and also via Web. Based on debian. Good howtos!

To be fair, kvm modules are also included in the stock ovz rhel6 kernel.

[...]
Previous Topic: openvz and ftp connection tracking for non-default ports
Next Topic: Netstat on Deb ovz vs Deb Proxmox
Goto Forum:
  


Current Time: Fri Dec 14 21:56:40 GMT 2018