Difference between revisions of "Installation on Debian"

From Linux-VServer

Jump to: navigation, search
(added util-vserver by source)
Line 20: Line 20:
  
 
=== Install util-vserver by source ===
 
=== Install util-vserver by source ===
Occasionally, Debian's util-vserver package can be too old. So, we'll need to compile from [[http://people.linux-vserver.org/~dhozac/t/uv-testing/ source]].
+
Occasionally, Debian's util-vserver package can be too old. So, we'll need to compile from [http://people.linux-vserver.org/~dhozac/t/uv-testing/ source].
  
 
First, install the required packages for util-vserver to compile.
 
First, install the required packages for util-vserver to compile.

Revision as of 16:18, 15 May 2009

This guide is written against Debian Etch (4.0) and works on Lenny (5.0) as well. Both releases include kernel linux-image-vserver-686, so no manual patching is needed. Hence, Installation on Debian Etch/Lenny is pretty easy and straightforward.

If you need to compile your own kernel, you need to apply the vserver-version.patch. Details at 2007/Apr/25


Contents

Packages installation

The packages required by Linux-VServer are:

  • linux-image-vserver-686 - This is the current kernel, use linux-image-vserver-amd64 on 64-bit systems, you can still create 32-bit guests
  • util-vserver - These are the utilities used to administer the guests
  • ssh - This is probably already installed, but just in case it isn't

All the packages you need can be obtained via

aptitude install linux-image-vserver-686 util-vserver ssh

so run this as root and reboot. To check out wherever everything went fine you may run

uname -r

and check that kernel version contains vserver, e.g. 2.6.18-4-vserver-686. That's it.

Now that the host system is ready, you can proceed with building guests.

Install util-vserver by source

Occasionally, Debian's util-vserver package can be too old. So, we'll need to compile from source.

First, install the required packages for util-vserver to compile.

apt-get install vlan dietlibc-dev pkg-config libnss3-dev

Then, we configure util-vserver

./configure --prefix=/usr --enable-release --mandir=/usr/share/man \
--infodir=/usr/share/info --sysconfdir=/etc --enable-dietlibc \
--localstatedir=/var --with-vrootdir=/home

Note: You should change --with-vrootdir accordingly

Finally, we run make to finalise the installation

make && make install install-distribution

Running vserver-info will show you that the proper util-vserver is installed. :)

Versions

Debian already contains vservers kernels, so no manual patching and compiling is needed.

Debian release Kernel version VServer version
Etch 2.6.18+6 2.0.2.2-rc9
Lenny 2.6.26+17 2.3.0.35

Issues with the current 2.6.26 Kernel

Hard CPU scheduling

This will not work in the Debian 'Lenny' Kernel.

Unification and Chroot Security Problems

Linux-Vserver uses file xattrs to protect guest superusers from being able to view files above their root, preventing access to host file. The patch used in Debian Lenny contains a different position of the flag which controls this barrier to escaping a guests chrooted enviroment. There is also a discrepancy between the immutable-unlink flag used for file unification. This creates a considerable security issues for anyone who:

  • has created a guest with a Debian 2.6.26-*-vserver kernel and wishes to use it with another kernel.
  • has created a guest with a different kernel and wishes to use it on a Debian 2.6.26-*-vserver kernel based host.
  • has unified guests with a Debian 2.6.26-*-vserver kernel and wishes to use them with another kernel.
  • has unified guests with a different kernel and wishes to then it on a Debian 2.6.26-*-vserver kernel based host.

In effect, the barrier normally in place for guest servers is not recognised by the kernel in the situation above and/or immutable links will not function correctly (failinf to break when overwritten) in a unified guest setup.

fixing the problem

As of writing this issue has not been corrected within the Debian archive. To fix the barrier flags for a current kernel, see these instructions. In order to fix the problem in unified environment each file on each server must be unlinked then the unification re-applied. These fixes must be applied whenever moving vserver guest from or to the Debian 'Lenny's vserver kernel.

For more details and a more concise explanation see Bertls IRC explanation .

A script for handling the unification problem with having to re-unify is given at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508523

References

Personal tools