Linux-VServer - User contributions [en]

Howto HostAuth

2008-03-07T05:08:55Z

Volkris: Added use case

== What is this? ==

nss_vserver is a nss authentication module for linux-vserver powered systems which allows processes running on the host (sshd, getty) to authenticate users that exist on guests.

The module should almost transparently drop in to a modern Linux system: PAM would call its pam_unix module, which would in turn look through the nss modules to complete the process.

If you want to complete the guest login process, you should also get a modified version of vslogin linked to below. vslogin will pick up after authentication and deliver the user to a shell on his guest.

Note that with nss_vserver you don't need the syncshadows included in the vserverauth tarball.

== Why would I use it? ==

Using nss_vserver and vslogin you could run a single instance of sshd on the host. This host-based server would verify the credentials of a user on a guest and then vslogin would take care of presenting the user a guest-based shell.

== Installation Instructions ==

On linux, just run

<code>

make install

</code>

After, try to run

<code>

make test

</code>

To see if it works.

== How to remove it from system? ==

Just run

<code>

make uninstall

</code>

== Use with vslogin ==

After you have installed module, (and have vslogin copied to /sbin/ and suid-root) you are ready: try to login into a guest, say one named "test" with user "user", by loggin in into the host with username "test-user" or "user@test." You should find yourself logged into the guest.

== Caveats ==

=== Security ===
WARNING! If you have installed vslogin, NEVER give shell access to your host to users -- any user on host, who able to execute programs and modify environment will be able to log into guests as anybody he wants!

=== Usernames and guest names with dashes ===

Avoid using usernames or guest names with dashes.

The current version only tries one configuration while searching for the user in guest databases, which can cause problems:

* User "user" on guest "ser-ver" when written as "user@ser-ver" will work fine, while "ser-ver-user" will be threated as user "ver-user" on vserver "ser".
* User "us-er" on guest "server" when written as "guest-us-er" will work fine, while "us-er@guest" will be threated as user "er@guest" on vserver "us".

If you must have dashes, use the syncshadows method instead.

== Download links ==

nss_vserver: http://dev.call2ru.com/vs/nss_vserver.tar.bz2

modified vslogin: http://dev.call2ru.com/vs/vserverauth.tar.gz

== Authors and copyright ==

nss_vserver was written by Anton Fedorov <datacompboy@call2ru.com> 19 march 2006 and is public domain; feel free to use it as you want.

vslogin was written by Alec Thomas (http://swapoff.org/LinuxVServer)

Howto HostAuth

2008-03-07T01:42:32Z

Volkris: Clarified what's going on based on my own experience

== What is this? ==

This is PAM host-auth module for linux-vserver powered systems.

The nss_vserver module allows processes running on the host (sshd, getty) to authenticate users that exist on guests.

If you want to complete the guest login process, you should also get a modified version of vslogin linked to below. vslogin will pick up after authentication and deliver the user to a shell on his guest.

Note that with nss_vserver you don't need the syncshadows included in the vserverauth tarball.

== Installation Instructions ==

On linux, just run

<code>

make install

</code>

After, try to run

<code>

make test

</code>

To see if it works.

== How to remove it from system? ==

Just run

<code>

make uninstall

</code>

== Use with vslogin ==

After you have installed module, (and have vslogin copied to /sbin/ and suid-root) you are ready: try to login into a guest, say one named "test" with user "user", by loggin in into the host with username "test-user" or "user@test." You should find yourself logged into the guest.

== Caveats ==

=== Security ===
WARNING! If you have installed vslogin, NEVER give shell access to your host to users -- any user on host, who able to execute programs and modify environment will be able to log into guests as anybody he wants!

=== Usernames and guest names with dashes ===

Avoid using usernames or guest names with dashes.

The current version only tries one configuration while searching for the user in guest databases, which can cause problems:

* User "user" on guest "ser-ver" when written as "user@ser-ver" will work fine, while "ser-ver-user" will be threated as user "ver-user" on vserver "ser".
* User "us-er" on guest "server" when written as "guest-us-er" will work fine, while "us-er@guest" will be threated as user "er@guest" on vserver "us".

If you must have dashes, use the syncshadows method instead.

== Download links ==

nss_vserver: http://dev.call2ru.com/vs/nss_vserver.tar.bz2

modified vslogin: http://dev.call2ru.com/vs/vserverauth.tar.gz

== Authors and copyright ==

nss_vserver was written by Anton Fedorov <datacompboy@call2ru.com> 19 march 2006 and is public domain; feel free to use it as you want.

vslogin was written by Alec Thomas (http://swapoff.org/LinuxVServer)

Documentation

2008-03-02T05:28:34Z

Volkris: Fixed Howto HostAuth link

<div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;">
[[Image:Icon-Caution.png|left]]
We are currently migrating to MediaWiki from our old system, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.

'''To ease migration we created a [[List of old Documentation pages]].'''
</div>

== Introduction ==

* [[Overview|Virtualization Overview]]
* [[Usage Scenarios]]
* [[Feature Matrix]]

== Installation ==

* [[Installation Considerations]]
* [[Installation on Linux 2.6]]
* [[Installation on ArchLinux]]
* [[Installation on CentOS]]
* [[Installation on Debian]]
* [[Installation on Fedora]]
* [[Installation on Gentoo]]
* [[Installation on Mandrake]]
* [http://pld-linux.org/Vserver Installation on PLD-Linux]
* [[Installation on Redhat]]
* [[Installation on Slackware]]
* [[Installation on SuSE/OpenSUSE]]
* [[Installation on Ubuntu]]

== Configuration ==

* [[util-vserver:Documentation|util-vserver Documentation]]
* [[vcd:Documentation|VServer Control Daemon Documentation]]
* [[yum-patch|How to patch vyum]]
* [[yum-upgrade-3.2.4|Upgrading existing installations to yum-3.2.4]]
* [[Share a directory among multiple guests]]

== Guides and Howtos ==

* [[util-vserver:Howto virtualize an exisiting Linux server|Howto virtualize an existing Linux server]]
* [[VCMD HowTo]]
* [[Howto make bsd-style init sysv-compatible|Howto make Bsd-style init sysv-compatible (archlinux guest system)]]
* [[Installing 32-bit Fedora on 64-bit Debian]]
* [[Installing Ubuntu on Debian]]
* [[Installing an openSUSE vserver guest]]
* [[Networking vserver guests]]
* [[Howto HostAuth]]

== Lists & Theory ==

* Basic configuration
** [[Capabilities and Flags]]
** [[CPU Scheduler]]
** [[Disk Limits and Quota]]
** [[Resource Limits]]
*** [[Memory Limits]]
** [[Virtual System Information]]
** [[Unification]]

* Security Considerations
** [[Secure Capabilities]]
** [[Secure chroot Barrier]]
** [[Secure Device Nodes]]
** [[Secure ProcFS Entries]]

* Performance and Stability
** [[Virtualization Overhead]]

* Implementation Details
** [[Context Accounting]]
** [[Filesystem Attributes]]
** [[Filesystem Tagging]]
** [[Filesystem Namespaces]]
** [[Kernel Userspace Helper]]
** [[Mainline Kernel Virtualization]]
** [[ProcFS]]
** [[Syscall Command Switch]]

== External Resources ==

Howto HostAuth

2008-03-02T05:27:13Z

Volkris: HowtoHostAuth moved to Howto HostAuth: collision with oldwiki?

== What is this? ==

This is host-auth module for linux-vserver powered systems.

Read about linux-vserver at http://linux-vserver.org/.

nss_vserver module allows you to auth users from vservers on host via standard PAM auth. If you want to make user login into their vserver via host, you should also get a bit modified vslogin (originally written by

Alec Thomas, http://swapoff.org/LinuxVServer) from http://linux-vserver.org/HowtoHostAuth

With using nss_vserver you not needed in syncshadows daemon from vserverauth.tar.gz -- only vslogin

== How to build and install? ==

On linux, just run

<code>

make install

</code>

After, try to run

<code>

make test

</code>

To see if it works.

== How to remove it from system? ==

Just run

<code>

make uninstall

</code>

== How to use it? ==

After you have installed module, put vslogin to /sbin/, make it suid-root, and you are ready -- try to login into vserver named "test" with user "user" by loggin in into host with username "test-user" or "user@test" -- you should login fine and get into vserver.

WARNING! If you have installed vslogin, NEVER give shell access to your host to users -- any user on host, who able to execute programs and modify environment will be able to log into vservers as anybody he want!

== Usernames and vserver names with dashes ==

Avoid using usernames or vserver names with dashes.

Because current version try only one configuration while searching for user in vserver db.

User "abc" on vserver "efg-hij" when written as "abc@efg-hij" will work fine, while "efg-hij-abc" will be threated as user "hij-abc" on vserver "efg".

User "abc-def" on vserver "efg" when written as "efg-abc-def" will work fine, while "abc-def@efg" will be threated as user "def@efg" on vserver "abc".

If you got problem with that -- use syncshadows method.

== Download links ==

nss_vserver: http://dev.call2ru.com/vs/nss_vserver.tar.bz2

fixed vslogin: http://dev.call2ru.com/vs/vserverauth.tar.gz

== Author and copyright ==

nss_vserver is written by Anton Fedorov <datacompboy@call2ru.com> 19 march 2006

This code is public domain, feel free to use it as you want.

HowtoHostAuth

2008-03-02T05:27:13Z

Volkris: HowtoHostAuth moved to Howto HostAuth: collision with oldwiki?

#REDIRECT [[Howto HostAuth]]

Documentation

2008-02-29T19:22:20Z

Volkris: Added HowtoHostAuth to howtos section

<div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;">
[[Image:Icon-Caution.png|left]]
We are currently migrating to MediaWiki from our old system, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.

'''To ease migration we created a [[List of old Documentation pages]].'''
</div>

== Introduction ==

* [[Overview|Virtualization Overview]]
* [[Usage Scenarios]]
* [[Feature Matrix]]

== Installation ==

* [[Installation Considerations]]
* [[Installation on Linux 2.6]]
* [[Installation on ArchLinux]]
* [[Installation on CentOS]]
* [[Installation on Debian]]
* [[Installation on Fedora]]
* [[Installation on Gentoo]]
* [[Installation on Mandrake]]
* [http://pld-linux.org/Vserver Installation on PLD-Linux]
* [[Installation on Redhat]]
* [[Installation on Slackware]]
* [[Installation on SuSE/OpenSUSE]]
* [[Installation on Ubuntu]]

== Configuration ==

* [[util-vserver:Documentation|util-vserver Documentation]]
* [[vcd:Documentation|VServer Control Daemon Documentation]]
* [[yum-patch|How to patch vyum]]
* [[yum-upgrade-3.2.4|Upgrading existing installations to yum-3.2.4]]
* [[Share a directory among multiple guests]]

== Guides and Howtos ==

* [[util-vserver:Howto virtualize an exisiting Linux server|Howto virtualize an existing Linux server]]
* [[VCMD HowTo]]
* [[Howto make bsd-style init sysv-compatible|Howto make Bsd-style init sysv-compatible (archlinux guest system)]]
* [[Installing 32-bit Fedora on 64-bit Debian]]
* [[Installing Ubuntu on Debian]]
* [[Installing an openSUSE vserver guest]]
* [[Networking vserver guests]]
* [[HowtoHostAuth]]

== Lists & Theory ==

* Basic configuration
** [[Capabilities and Flags]]
** [[CPU Scheduler]]
** [[Disk Limits and Quota]]
** [[Resource Limits]]
*** [[Memory Limits]]
** [[Virtual System Information]]
** [[Unification]]

* Security Considerations
** [[Secure Capabilities]]
** [[Secure chroot Barrier]]
** [[Secure Device Nodes]]
** [[Secure ProcFS Entries]]

* Performance and Stability
** [[Virtualization Overhead]]

* Implementation Details
** [[Context Accounting]]
** [[Filesystem Attributes]]
** [[Filesystem Tagging]]
** [[Filesystem Namespaces]]
** [[Kernel Userspace Helper]]
** [[Mainline Kernel Virtualization]]
** [[ProcFS]]
** [[Syscall Command Switch]]

== External Resources ==

Howto HostAuth

2008-02-29T19:21:03Z

Volkris: Imported from old wiki, fixed download links