[00:31] micah (micah@adsl-68-78-111-196.dsl.emhril.ameritech.net) joined #vserver. [00:31] hi micah! [00:31] hey Bertl [00:32] I got the kernel booted, now I am tyring to get util-vserver to compile [00:32] which version? [00:32] it can't find the ext2fs headers even though I did ./configure --with-kerneldir=/usr/src/linux [00:32] 0.28 [00:32] get 0.29.2 and try again [00:32] oh a newer verison :) [00:33] .29.2 is not stable though? [00:33] it's a pre to the next stable ... [00:33] you can test with 0.29 should work too [00:33] but I#d suggest 0.29.2 [00:34] I dont see where it is on the site [00:34] http://www-user.tu-chemnitz.de/~ensc/util-vserver/pre/ [00:34] http://www-user.tu-chemnitz.de/~ensc/util-vserver/ [00:34] ok, trying that one [00:35] still can't find the ext2fs headers :( [00:35] ./configure --with-kerneldir=/usr/src/linux [00:35] install the ext2 library [00:35] development version ... [00:35] hrm [00:35] yeah [00:35] I thought I already had it installed :p [00:35] getting it [00:36] i thought I had it installed or it was part of the kernel source, my fault [00:36] *lol* [00:36] For those wannabe hackers who are too stupid to get it: THIS IS A WIKI! google for that! [00:36] if you believe it or not, it was necessary ... [00:36] must have been a real genious ;> [00:36] Bertl: configure worked, but make did not :( [00:36] what do you get on make? [00:36] shall I paste? [00:37] about 10 lines [00:37] yeah [00:37] then mv -f "lib/.deps/lib_libvserver_a-syscall.Tpo" "lib/.deps/lib_libvserver_a-syscall.Po"; else rm -f "lib/.deps/lib_libvserver_a-syscall.Tpo"; exit 1; fi [00:37] In file included from lib/syscall.c:25: [00:37] lib/vserver-internal.h: In function `vserver': [00:37] lib/vserver-internal.h:99: error: `__NR_vserver' undeclared (first use in this function) [00:37] lib/vserver-internal.h:99: error: (Each undeclared identifier is reported only once [00:37] lib/vserver-internal.h:99: error: for each function it appears in.) [00:37] make[1]: *** [lib/lib_libvserver_a-syscall.o] Error 1 [00:37] make[1]: Leaving directory `/usr/src/vserver/util-vserver-0.29.2' [00:37] make: *** [all] Error 2 [00:37] clean the source dir, and reconfigure [00:37] .28 doesn't seem to have that problem [00:38] k [00:38] same problem [00:38] did a make clean [00:38] then a ./configure --with-kerneldir=/usr/src/linux [00:38] then make [00:39] .28 compiles all the way through [00:39] did you remove the config.cache? [00:39] there isn't one [00:39] ls config* [00:39] config.h config.h.in config.log config.status configure configure.ac [00:40] okay, remove the status [00:40] same result [00:41] what arch is this? [00:41] i686 [00:41] hmm ... strange ... [00:42] ya [00:42] I think I'd like to try the .28 to see how to do this [00:42] I could make it and make install it [00:42] well, you could search the log [00:42] which log? [00:42] enrico handled a similar issue a few days ago .. but I don't remember how ... [00:42] irc-log [00:43] ah, ok [00:43] I think I want to try and use .28 right now [00:43] because it works, I want to get a vserver working so I can see how it works! [00:43] okay [00:43] please send the error message to the ml, or enrico [00:43] i've been following the step-by-step wiki page (and I updated it to have a the newest patch btw.) [00:44] what is enrico's email? [00:44] Enrico Scholz [00:44] but cc it to the ml ... [00:45] great, thanks, I am subscribing to the list right now [00:45] will do that [00:45] in the meantime [00:46] I've been following http://www.linux-vserver.org/index.php?page=Step-by-Step+Guide [00:46] the step I am on now says, "Create a vserver!" [00:46] but it doesn't link to where the instructions are for doing that :) [00:47] i recall the person who was here last night doing this on debian woody [00:47] and using a program to create it? [00:47] you can do that easily with the alpha util-vserver branch ... [00:48] ah, but I am using the .28 [00:48] yeah, I know ... [00:48] Action: micah gets yesterday's irc logs [00:50] hmm [00:50] vserver build? [00:51] vserver build [00:51] takes a little bit [00:51] copies your host server ... [00:51] what does it copy? [00:51] everything ... [00:51] heh [00:51] I dont think I have enough space [00:51] to have everything [00:52] it just gets /bin /etc /sbin /usr ? [00:52] erp, just ran out of space [00:53] so you do need a full copy of the host server for each vserver? [00:53] I was hoping to be able to trim it down a lot, ie. just make an apache virtual hosting setup, that would only do apache [00:55] nope [00:55] as I said, the alpha branch does a minimal server install [00:55] it uses the debootstrap method [00:56] a similar way is implemented in the debiannewvserver script [00:56] ah interesting [00:56] but do not ask me where to get or how it works ... [00:56] heh [00:56] I'll look for it [00:56] micah: I've build a statically linked apache vserver that only contains apache and a few libs. [00:56] micah: same with mysqld, powerdns, etc. [00:56] Only 10 files in each vserver or so (apart from the content) [00:56] JonB (~NoSuchUse@129.142.112.33.ip.tele2adsl.dk) left irc: Quit: Leaving [00:57] Zoiah: do you have any instructions on how to do it? I am wanting to use vserver for hosting websites for non-profits, but I want to separate each one into their own vserver for security [00:58] micah: just build a chrooted version of the apache installation. [00:58] micah: then use that as the vserver and use the appropriate S_START and S_STOP variables. [00:58] micah: lots of documentation on the net how to make chrooted versions of software. [00:59] Zoiah: hmm, I dont follow you [01:00] Zoiah: so I build apache, something like this: http://penguin.epfl.ch/chroot.html [01:00] Zoiah: then what? [01:00] Yup. [01:00] micah: then you start it with vserver. :) [01:00] how do you do that? [01:00] micah: make a config-file, put the apachectl (or whatever you want) in the S_STOP/S_START variables (if you vserver supports that). [01:20] zoiah: i dont understand what the S_STOP/S_START variables are [01:20] Action: micah is almost finished setting up a choot apache [01:30] Zoiah: hrm, I got a chroot apache installed, but it is 390 files :( [01:30] and 5.6 megs [01:31] got it down to 34 files by gteting rid of the icons, the htdocs, and the man pages [01:32] but it is still 4.2megs with the /lib directory [01:35] does anyone have a vservers/.conf I can look at? [01:35] sure .. sec [01:35] I'm trying to start vserver with my apache chroot [01:37] micah: I have it statically linked, so I don't have a /lib. :) [01:37] Zoiah: oh, nice, how do you do that? [01:38] http://vserver.13thfloor.at/Stuff/vserver.conf [01:38] LDFLAGS="-static" [01:38] Zoiah: is that an apache configuration option? [01:38] Bertl: thanks [01:39] np [01:39] micah: it's an environement (I can't spell) variable. [01:39] micah: make passes it to LD or something. [01:39] Zoiah: so if I do export LDFLAGS="-static" before I run a make in apache it will make it static? [01:39] micah: yup. [01:40] Bertl: tried to do: vserver vserver exec /apache/bin/apachectl with that vserver.conf (after modifying it), it says: [01:40] micah: although, you have to do a bit more, because nss-stuff is still dynamic by default, so I had to recompile glibc with some obscure ./configure option. [01:40] No directory for this vserver: /vservers/vserver [01:40] micah: did you put it in /vservers/vserver / [01:40] ? [01:40] Zoiah: did I put what there? [01:40] micah: the chrooted installation. [01:41] Zoiah: no, it is in /www or /apache [01:41] micah: vserver expects it in /vservers/ [01:41] Zoiah: ah, ok [01:41] in alpha util-vserver this is a symlink in the config tree [01:41] ln -s /apache /vservers/apache [01:41] Bertl: that sounds like a good way [01:42] that's why I mentioned it ;) [01:43] Zoiah: hrm, I remade apache that way, but it didn't make it static, maybe I need to reconfigure it first [01:45] ok! [01:45] vserver apache exec /apache/bin/apachectl start [01:46] looks sorta like it worked? [01:46] SIOCSIFADDR: File exists [01:46] SIOCSIFFLAGS: Cannot assign requested address [01:46] SIOCSIFNETMASK: Cannot assign requested address [01:46] SIOCSIFBRDADDR: Cannot assign requested address [01:46] SIOCSIFFLAGS: Cannot assign requested address [01:46] ipv4root is now 192.168.0.99 [01:46] Host name is now pond.riseup.net [01:46] Domain name is now [01:46] New security context is 1000 [01:46] /apache/bin/apachectl start: httpd started [01:46] the ip is already defined [01:46] if you want to 'use' a defined ip, remove the eth0: part [01:47] otherwise the vserver script will create an alias ... [01:47] (see the errors above) [01:47] so, ok, how do I tell what is going on? :) [01:47] vserver-stat says: [01:47] CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME DESCRIPTION [01:47] 0 83 986MB 122kB 10m12.29 3m34.91 1h24m37 root server [01:47] 1000 6 15MB 1kB m00.00 m00.01 m29.65 apache Qemu Example Vserver [01:47] http://vserver.13thfloor.at/Stuff/VServer-IP-Setup-0.1.txt [01:48] I am not sure if I need a defined IP [01:48] well, it's simple is 192.168.0.99 already defined or not? [01:48] yes, that is my IP on eth0 in my root machine [01:49] so you do not want the script to create another alias, and take it down on shutdown right? [01:51] well, I am not sure [01:51] what I want is: [01:51] hehe [01:51] okay, another simpler question: [01:51] I want to setup these apache chroot vservers for virtual hosts, and I wont be having different static IPs for each [01:52] do you want to use 192.168.0.99, when the apache vserver is don? [01:52] is that possible? [01:52] Bertl: yes [01:52] okay, then you do NOT want the scripts to take it down on vserver stop ;) [01:52] right [01:52] but can the vserver have the same IP as the host? [01:52] which means, you DO want to reuse an existing ip for that vserver [01:53] yes [01:53] in other words: 'remove the eth0: part' [01:53] in the config, ok [01:53] yep [01:53] ok, thats easy [01:54] so vserver apache status shows me that the vserver is running with some processes running [01:54] good! [01:55] and lynx --dump http://192.168.0.99:8088 works :) [01:55] even better! [01:55] indeed [01:55] it is weird, I can't see the processes on the root machine? [01:55] any processes at all, vserver or anything [01:57] how can I tell how much resources this is taking up? [02:11] you can see the processes in the context 1 [02:11] vserver-stat shows you the resources [02:11] ? [02:11] how do you see context 1? [02:11] chcontext --ctx 1 ps auxwww [02:12] oh interesting [02:12] chcontext --ctx 1000 ps auxwww [02:12] that is cool [02:12] now that I've statically compiled apache, it should be even less :) [02:13] well, not necessarily [02:14] for example (hard) linking the libs into the apache vserver would reduce it further, and also reduce the overall memory use [02:14] 1 megabyte less :) [02:34] now I need to figure out how I can justify how this is better than a simple jail [02:34] you guys were saying before that the vserver gives you a chroot/jail setup without the chroot holes right? [02:34] hmm, that is explained easily [02:34] if you do it properly, yes [02:35] please do explain, so I can explain to the people who will decide which way we go :) [02:35] (means using the barrier and /proc security) [02:35] basically the vserver has no caps and no permissions [02:35] caps = ? [02:36] if you now secure the chroot jail with the barrier, and activate the /proc security, then somebody hacking apache, can do nothing ... [02:36] caps = linux capabilities ... [02:36] and this is different from a traditional chroot/jail how? [02:37] you can easily escape a chroot [02:37] (i hope I'm not being annoying, I'm trying to understand) [02:37] no problem ... [02:37] and you can abuse root rights to create device nodes in a root chail [02:38] s/chail/jail/ [02:38] both isn't possible with vserver [02:38] scenario 1: I have a traditional jail/chroot with php and something insecure, like php-nuke. Someone manages to exploit php nuke and do things as the jail user, the exploter could somehow break out of the jail and do things on the system. [02:39] yeah, in vserver a) he doesn' [02:39] t see anything else than apache [02:39] scenario 2: I have a vserver jail/chroot with /proc security and barrier, running apache and php and inseucre php-nuke. Someone manages to exploit php nuke and could mess up that particular site, but it is impossible for them to break out of the vserver [02:39] yes [02:40] and he can not even mess with the system from inside [02:40] so in scenario 1 the exploiter can create device nodes and break from the jail, in scenario 2 he cannot see anything but apache and cannot create device nodes and cannot break from the jail [02:40] there are probably other differences as well, but yes [02:41] basically vserver is designed to have root inside ... [02:41] so becoming root in a vserver doesn't help much ;) [02:41] and once you become root in a vserver, you cannot become root in the host server [02:42] that is the idear behind vserver [02:42] otherwise it wouldn't be safe to allow root access to a vserver [02:42] interesting [02:43] am I using the "barrier" and /proc security now? [02:43] probably not [02:44] what is your vserver path? [02:44] /vservers/apache is a symlink to /www [02:44] okay so www is the actual vserver dir? [02:44] but I can move /www into /vservers/apache if necessary [02:44] yes [02:45] hrm, it would be better to have it in /vservers [02:45] ok, I can do that easily [02:47] ok, that is done [02:47] now do chmod 000 /vservers [02:47] and chattr +t /vservers [02:48] this defines the 'barrier' [02:48] in devel or on 2.6.x this is solved via a separate flag [02:51] hmm, I can't seem to exec apachectl (No such file or directory) [02:51] what is the root? if I do vserver apache exec /apache/bin/apachectl start should that work? [02:51] nope [02:51] /vservers/apache is the root [02:52] hmm, still can't find it [02:52] doing: [02:52] vserver apache exec /vservers/apache/apache/bin/apachectl start [02:53] which is wron [02:53] +g [02:53] vserver apache exec /bin/apachectl start [02:53] might work .. not sure about the arg [02:53] Can't execute /bin/apachectl (No such file or directory) [02:53] Bertl: he has the apache part in /apache on the apache vserver [02:53] hmm, okay [02:54] vserver apache exec /apache/bin/apachectl start [02:54] then [02:54] confusing ... [02:54] Can't execute /apache/bin/apachectl (No such file or directory) [02:54] micah: vserver apache enter [02:54] okay, where _is_ your apachectl? [02:54] err, my fault, it can't launch apachectl [02:54] _where_ is your apachectl located there? [02:54] but I can launch httpd :) [02:54] doh. [02:55] its because apachectl depends on bash which depends on sharedlibs [02:55] neither of which the chroot has [02:55] okay .. [02:55] Bertl: ok, I did the +t /vservers and the chmod 000 /vservers [02:56] so that means I've got the barrier and the /proc security [02:56] ? [03:09] nope, that is the abrrier [03:09] but I gues syou do not mount /proc inside the chroot right? [03:11] paul (~irssi@195.202.59.230) left irc: Quit: leaving [03:46] is it possible to dynamically load a library inside of a vserver if you hard link it? [03:46] yes [03:47] and you can make use of another feature available in vserver [03:47] the library is outside in the master host [03:47] immutable and immutable unlink flag [03:47] the goal is to make apache take up the least amount of resources, if I dont need a separate libc for each instance... [03:48] yeah, that is usually done amongh vservers and it's called unification ... [03:48] interesting [03:48] this is sounding good [03:48] each vserver gets a hard link of the library [03:49] this hard link means that inode cache (and for RO even memory mappings) are shared [03:49] a glibc using up 5MB, used in 10 vservers only contributes 0.5MB to each ;) [03:50] and reduces the in memory footprint by a factor of 10 [03:50] do they share the memory? or just the disk space? [03:50] for RO mappings, as for libraries both [03:51] same for executables (they are ro too) [04:12] that is somehting I will have to figure out, but first I must document what I did so I dont forget that [04:12] :) [04:12] make that, best on the wiki ... or ml ;) [04:13] right [04:16] dilox (~dilox@host254-8.pool8249.interbusiness.it) joined #vserver. [04:17] Bertl: and it is possible to share one IP throughout the vservers for different apache installs? Is that what http://vserver.13thfloor.at/Stuff/VServer-IP-Setup-0.1.txt is all about? [04:17] hi bertl [04:17] hi dilox! [04:17] how are u? [04:17] micah: well, basically yes, but you cannot bind them to the same port ... [04:18] dilox: I'm okay ... a little tired ... [04:18] Bertl: that can be a problem, so do you use iptables or proxypass or somehting to have the host server redirect people to the right ports in the vservers? [04:18] micha i think rinetd is very easy to use [04:18] that might be an option, using different ips is also an option ;) [04:19] Bertl: yeah, don't have that option of IPs :( [04:19] dilox: is that how it is possible? [04:19] well, then you need different ports ... [04:19] and some kind of proxy ... [04:19] but that problem isn't different from 'normal' multiple apache setups [04:19] right, sounds like iptables, rinetd or apache proxypass would be the options [04:20] ok, we'll do some research on that, not there yet :) [04:21] soor (~as@pD951A78C.dip.t-dialin.net) left irc: Ping timeout: 480 seconds [04:22] bertl.. i've got some problem stopping vserver [04:22] what's the correct way to kill it? [04:23] i used vserver firts stop but no works! [04:27] dilox (~dilox@host254-8.pool8249.interbusiness.it) left irc: Quit: Uscita dal client [04:29] dilox (~dilox@host254-8.pool8249.interbusiness.it) joined #vserver. [04:33] Bertl: in order to do the library unification immutable stuff, do I need a separate patch? [04:33] for the immutable linkage flags [04:35] dilox: back again? [04:36] micah: no separate patch, it's included ... [04:36] yes.. i lost connection for a while [04:36] me too ... [04:36] Bertl: ok, what is the http://www.13thfloor.at/vserver/s_release/v1.26/split-2.4.25-vs1.26.tar compared to the http://www.13thfloor.at/vserver/s_release/v1.26/patch-2.4.25-vs1.26.diff? [04:36] ok [04:36] is it just the patch split up into different patches? [04:37] micah: yeah broken out .. have a look at it [04:37] bertl i got problem stopping vserver, i did vserver first stop but no works [04:37] what does it say? [04:37] Can't set the new security context [04:37] : Invalid argument [04:37] sleeping 5 seconds [04:38] then... [04:38] chcontext version 0.29 [04:38] chcontext [ options ] command arguments ... [04:38] chcontext allocate a new security context and executes [04:38] a command in that context. [04:38] By default, a new/unused context is allocated [04:38] hmm, okay, please let me know what testme.sh gives? [04:39] http://vserver.13thfloor.at/Stuff/testme.sh [04:39] ok [04:39] one minute [04:39] i've to run it inside vserver? [04:39] nope, on the host [04:40] testhim ;-) [04:40] ehi... only 201 failed [04:40] fine, I need the first 4 lines [04:41] Linux-VServer Test [V0.07] (C) 2003-2004 H.Poetzl [04:41] chcontext is working. [04:41] chbind is working. [04:41] Linux 2.4.23-vs1.22 i686/0.29/0.29 [J] [04:41] then [04:41] --- [04:41] [001]# succeeded. [04:41] [011]# succeeded. [04:41] [031]# succeeded. [04:41] [101]# succeeded. [04:41] [102]# succeeded. [04:41] good you are on vs1.22 (which is insecure) and use jack's broken 0.29 tools ;) [04:41] [201]# failed. [04:41] [202]# succeeded. [04:42] don't say I have to recomplie kernel [04:42] well, depends what you want, it's probably not kernel related (your issues) [04:42] switching to util-vserver would be a good idea though [04:43] ahh [04:43] I understand.. so remove vserver and install util-vserver right? [04:43] unless you _are_ happy with the tools (some people are ;) [04:44] 0.29.2 is the latest "stable" version of them ... [04:44] http://www-user.tu-chemnitz.de/~ensc/util-vserver/pre/ [04:44] do u use an rpm based distro? [04:45] a .deb based [04:45] okay, then compiling them yourself would be the best choice ... [04:45] i installde util-vserver [04:45] now testme is ok [04:45] i show yuo [04:45] no need to .. [04:45]