Re: [gentoo-user] Increasing security [WAS: Rooted/compromised Gentoo, seeking advice [Solved?]

[Bill Longman]

On 08/16/2010 09:07 AM, Jarry wrote:
> On 16. 8. 2010 17:29, Mark Knecht wrote:
>> On Mon, Aug 16, 2010 at 7:16 AM, Bill Longman<bill.longman@×××××.com>:
>>>>
>>>> That is why I picked up Linux-VServer (actually, first I tried
>>>> OpenVZ but could not make it run). It is a kind of compromise,
>>>> where all guests share the same kernel. This brings certain
>>>> security implications, but on the other side, I can run dozens
>>>> of guest on a moderate machine, with 4-cores and 8GB memory
>>>> (i.e. a guest running bind takes just about 20MB of memory)...
>>>
>>> This looks rather interesting, Jarry. Is it simply a matter of compiling
>>> the vserver-sources and util-vserver? Did it take much time to set up
>>> the kernel for your box? Or is it pretty much a typical kernel setup?
>>> Any good tools in the util-vserver package?
>
> vserver-sources and util-vserver was all I needed. Kernel is
> pretty much like common, with ~10 additional options. util-vserver
> contains handy tools, like "v*" (* being emerge, esync, kill,
> limit, mount, ps, sched, etc.). Updating all gentoo-guests can be
> done with one command executed in host...
>
>>> Sounds very efficient.
>
> Really is. Now I'm running 27 guests, mostly gentoo but also
> some ubuntu and opensuse. Actually, it is possible to run any
> linux-based system (as I said all systems share the same kernel).
> There is also pretty good control over resources allocated
> to individual guests (disk, memory, cpu).
>
> Administration is very comfortable. Tasks like clonning,
> backup/restore, moving, migration, etc, are very easy to...
>
>> I guess the baselayout-vserver packages is somehow for setting up each
>> of the guests?
>
> Guests are installed using customised stage3 (baselayout2-based).
> After that, you work with them as with normal gentoo-system.

The Gentoo version of Solaris Zones! w00t!