Gentoo Archives: gentoo-user

From: Jarry <mr.jarry@×××××.com>
To: gentoo-user@l.g.o
Subject: Re: [gentoo-user] Increasing security [WAS: Rooted/compromised Gentoo, seeking advice [Solved?]
Date: Mon, 16 Aug 2010 16:09:50
Message-Id: 4C696255.20505@gmail.com
In Reply to: Re: [gentoo-user] Increasing security [WAS: Rooted/compromised Gentoo, seeking advice [Solved?] by Mark Knecht
1 On 16. 8. 2010 17:29, Mark Knecht wrote:
2 > On Mon, Aug 16, 2010 at 7:16 AM, Bill Longman<bill.longman@×××××.com>:
3 >>>
4 >>> That is why I picked up Linux-VServer (actually, first I tried
5 >>> OpenVZ but could not make it run). It is a kind of compromise,
6 >>> where all guests share the same kernel. This brings certain
7 >>> security implications, but on the other side, I can run dozens
8 >>> of guest on a moderate machine, with 4-cores and 8GB memory
9 >>> (i.e. a guest running bind takes just about 20MB of memory)...
10 >>
11 >> This looks rather interesting, Jarry. Is it simply a matter of compiling
12 >> the vserver-sources and util-vserver? Did it take much time to set up
13 >> the kernel for your box? Or is it pretty much a typical kernel setup?
14 >> Any good tools in the util-vserver package?
15
16 vserver-sources and util-vserver was all I needed. Kernel is
17 pretty much like common, with ~10 additional options. util-vserver
18 contains handy tools, like "v*" (* being emerge, esync, kill,
19 limit, mount, ps, sched, etc.). Updating all gentoo-guests can be
20 done with one command executed in host...
21
22 >> Sounds very efficient.
23
24 Really is. Now I'm running 27 guests, mostly gentoo but also
25 some ubuntu and opensuse. Actually, it is possible to run any
26 linux-based system (as I said all systems share the same kernel).
27 There is also pretty good control over resources allocated
28 to individual guests (disk, memory, cpu).
29
30 Administration is very comfortable. Tasks like clonning,
31 backup/restore, moving, migration, etc, are very easy to...
32
33 > I guess the baselayout-vserver packages is somehow for setting up each
34 > of the guests?
35
36 Guests are installed using customised stage3 (baselayout2-based).
37 After that, you work with them as with normal gentoo-system.
38
39 > QUESTION: Where does X run? In the host or separate copies in each guest?
40
41 If you need X, you can create a special guest for it, and run X
42 there. The only thing which must run in host are kernel-modules
43 (i.e. nvidia driver). I tested this only as an experiment, but
44 it works. I've heard of someone running X+Wine in vserver-guest.
45 It is also possible to run X+VMware+Windows in vserver-guest...
46
47 > For a long time I've wanted to set up a single piece of hardware for
48 > my parents, but with two screens, two keyboards, two mice. Each user
49 > would have what they expect in front of them physically but it's
50 > really a single computer. Can that be done using this software?
51
52 Frankly, I do not know. But for each guest you can setup different
53 tty and IP, so maybe it would be possible. Though I think maybe
54 some kind of terminal server would be more suitable...
55
56 Jarry
57
58 --
59 _______________________________________________________________
60 This mailbox accepts e-mails only from selected mailing-lists!
61 Everything else is considered to be spam and therefore deleted.

Replies