[Vserver] [x86] (PIV 2.80) 2.6.17-vs2.1.1-rc24 works with Mdv 2006.0

2006-07-12 Thread Nicolas Costes

Here are the results of my last test :

# cat /proc/cpuinfo
processor   : 0
vendor_id   : GenuineIntel
cpu family  : 15
model   : 3
model name  : Intel(R) Pentium(R) 4 CPU 2.80GHz
stepping: 4
cpu MHz : 2793.616
cache size  : 1024 KB
physical id : 0
siblings: 2
core id : 0
cpu cores   : 1
fdiv_bug: no
hlt_bug : no
f00f_bug: no
coma_bug: no
fpu : yes
fpu_exception   : yes
cpuid level : 5
wp  : yes
flags   : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca 
cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe 
constant_tsc pni monitor ds_cpl cid xtpr
bogomips: 5591.88

processor   : 1
vendor_id   : GenuineIntel
cpu family  : 15
model   : 3
model name  : Intel(R) Pentium(R) 4 CPU 2.80GHz
stepping: 4
cpu MHz : 2793.616
cache size  : 1024 KB
physical id : 0
siblings: 2
core id : 0
cpu cores   : 1
fdiv_bug: no
hlt_bug : no
f00f_bug: no
coma_bug: no
fpu : yes
fpu_exception   : yes
cpuid level : 5
wp  : yes
flags   : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca 
cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe 
constant_tsc pni monitor ds_cpl cid xtpr
bogomips: 5586.50



# uname -a
Linux MACHINE_NAME 2.6.17-vs2.1.1-rc24 #1 SMP Wed Jul 12 10:38:10 CEST 
2006 i686 Intel(R) Pentium(R) 4 CPU 2.80GHz unknown GNU/Linux



# sh testme.sh-0.15 -Lv
Linux-VServer Test [V0.15] Copyright (C) 2003-2006 H.Poetzl
chcontext is working.
chbind is working.
chcontext 0.30.210 -- allocates/enters a security context
This program is part of util-vserver 0.30.210

Copyright (C) 2004 Enrico Scholz
This program is free software; you may redistribute it under the terms of
the GNU General Public License.  This program has absolutely no warranty.
Linux 2.6.17-vs2.1.1-rc24 #1 SMP Wed Jul 12 10:38:10 CEST 2006 i686
Ea 0.30.210 273/glibc (S*) 
VCI: 0002:0101 273 03000116 (TbLgnP)
([EMAIL PROTECTED])
(gcc version 4.0.1 (4.0.1-5mdk for Mandriva Linux release 2006.0))
#1 SMP Wed Jul 12 10:38:10 CEST 2006
---
[000]# chcontext  true && chcontext --xid 45678 true
[000]# succeeded.
[001]# chcontext --xid 45678 egrep 'context|VxID' /proc/self/status
[001]# succeeded.
[011]# chcontext --secure --xid 45678 
mknod /tmp/testme.sh-0.15.bt9235/node c 0 0
[011]# succeeded.
[031]# chcontext  --hostname zaphod.9232 uname -a | grep -q zaphod.9232
[031]# succeeded.
[101]# chbind  --ip 192.168.0.42 true
[101]# succeeded.
[102]# chbind  --ip 192.168.0.1/255.255.255.0 --ip 10.0.0.1/24 true
[102]# succeeded.
[201]# chcontext --xid 45678 --flag fakeinit bash -c 'test $$ -eq 1'
[201]# succeeded.
[202]# chcontext  --flag fakeinit bash -c 'test $$ -eq 1'
[202]# succeeded.
---
[L01]# chcontext --xid 45601 bash -c 'true &'
[L01]# succeeded.
[D01]# chcontext bash -c 'true &'
[D01]# succeeded.
[L02]# chcontext --xid 45602 bash -c 'true | true'
[L02]# succeeded.
[D02]# chcontext bash -c 'true | true'
[D02]# succeeded.
[L03]# chcontext --xid 45603 bash -c 'true & true'
[L03]# succeeded.
[D03]# chcontext bash -c 'true & true'
[D03]# succeeded.
[L11]# chcontext --xid 45611 bash -c 'true >/dev/null' /dev/null' /dev/null
[L12]# succeeded.
[D12]# chcontext bash -c 'true /dev/null
[D12]# succeeded.
[L21]# chcontext --xid 45621 bash -c 'bash -c "true &"&'
[L21]# succeeded.
[D21]# chcontext bash -c 'bash -c "true &"&'
[D21]# succeeded.
[L22]# chcontext --xid 45622 bash -c 'bash -c "false | true &"&'
[L22]# succeeded.
[D22]# chcontext bash -c 'bash -c "false | true &"&'
[D22]# succeeded.
[L31]# chcontext --xid 45631 bash -c 'echo `ls`'
[L31]# succeeded.
[D31]# chcontext bash -c 'echo `ls`'
[D31]# succeeded.


-- 
  ,,
 (°>   Nicolas Costes
 /|\   IUT de La Roche / Yon
( ^ )  Clé publique: http://www.keyserver.net/
 ^ ^   Musique libre: http://musique-legale.info/ - 
http://www.jamendo.com/?s=concept


pgpF9bgeJrq9O.pgp
Description: PGP signature
___
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


[Vserver] [x86] (PIII 1133) 2.6.17-vs2.1.1-rc24 works with Mdv 2006.0

2006-07-12 Thread Nicolas Costes

Here are the results of another test :

# cat /proc/cpuinfo
processor   : 0
vendor_id   : GenuineIntel
cpu family  : 6
model   : 11
model name  : Intel(R) Pentium(R) III CPU family  1133MHz
stepping: 1
cpu MHz : 1130.646
cache size  : 512 KB
fdiv_bug: no
hlt_bug : no
f00f_bug: no
coma_bug: no
fpu : yes
fpu_exception   : yes
cpuid level : 2
wp  : yes
flags   : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca 
cmov pat pse36 mmx fxsr sse up
bogomips: 2262.60




# uname -a
Linux MACHINE_NAME 2.6.17-vs2.1.1-rc24 #1 SMP Wed Jul 12 10:48:16 CEST 
2006 i686 Intel(R) Pentium(R) III CPU family  1133MHz unknown 
GNU/Linux




# sh testme.sh-0.15 -Lv
Linux-VServer Test [V0.15] Copyright (C) 2003-2006 H.Poetzl
chcontext is working.
chbind is working.
chcontext 0.30.210 -- allocates/enters a security context
This program is part of util-vserver 0.30.210

Copyright (C) 2004 Enrico Scholz
This program is free software; you may redistribute it under the terms of
the GNU General Public License.  This program has absolutely no warranty.
Linux 2.6.17-vs2.1.1-rc24 #1 SMP Wed Jul 12 10:48:16 CEST 2006 i686
Ea 0.30.210 273/glibc (S*) 
VCI: 0002:0101 273 03000116 (TbLgnP)
([EMAIL PROTECTED])
(gcc version 4.0.1 (4.0.1-5mdk for Mandriva Linux release 2006.0))
#1 SMP Wed Jul 12 10:48:16 CEST 2006
---
[000]# chcontext  true && chcontext --xid 45678 true
[000]# succeeded.
[001]# chcontext --xid 45678 egrep 'context|VxID' /proc/self/status
[001]# succeeded.
[011]# chcontext --secure --xid 45678 
mknod /tmp/testme.sh-0.15.No9038/node c 0 0
[011]# succeeded.
[031]# chcontext  --hostname zaphod.9035 uname -a | grep -q zaphod.9035
[031]# succeeded.
[101]# chbind  --ip 192.168.0.42 true
[101]# succeeded.
[102]# chbind  --ip 192.168.0.1/255.255.255.0 --ip 10.0.0.1/24 true
[102]# succeeded.
[201]# chcontext --xid 45678 --flag fakeinit bash -c 'test $$ -eq 1'
[201]# succeeded.
[202]# chcontext  --flag fakeinit bash -c 'test $$ -eq 1'
[202]# succeeded.
---
[L01]# chcontext --xid 45601 bash -c 'true &'
[L01]# succeeded.
[D01]# chcontext bash -c 'true &'
[D01]# succeeded.
[L02]# chcontext --xid 45602 bash -c 'true | true'
[L02]# succeeded.
[D02]# chcontext bash -c 'true | true'
[D02]# succeeded.
[L03]# chcontext --xid 45603 bash -c 'true & true'
[L03]# succeeded.
[D03]# chcontext bash -c 'true & true'
[D03]# succeeded.
[L11]# chcontext --xid 45611 bash -c 'true >/dev/null' /dev/null' /dev/null
[L12]# succeeded.
[D12]# chcontext bash -c 'true /dev/null
[D12]# succeeded.
[L21]# chcontext --xid 45621 bash -c 'bash -c "true &"&'
[L21]# succeeded.
[D21]# chcontext bash -c 'bash -c "true &"&'
[D21]# succeeded.
[L22]# chcontext --xid 45622 bash -c 'bash -c "false | true &"&'
[L22]# succeeded.
[D22]# chcontext bash -c 'bash -c "false | true &"&'
[D22]# succeeded.
[L31]# chcontext --xid 45631 bash -c 'echo `ls`'
[L31]# succeeded.
[D31]# chcontext bash -c 'echo `ls`'
[D31]# succeeded.


NOTE : On current Mandriva releases, I have to rebuild the 
util-vserver-0.30.210-4mdk source RPM, because of strange unresolved 
dependencies (Typo in the SPEC file ?). See :

Problem : http://archives.linux-vserver.org/200606/0074.html
Solution for Mdv 2006.0:
  # urpmi rpm-build
  # urpmi vlan-utils libbeecrypt-devel e2fsprogs-devel
  # rpm --rebuild util-vserver-0.30.210-4mdk.src.rpm
  # urpmi /usr/src/RPM/RPMS/_arch_/util-vserver-*.rpm

With _arch_ your achitecture : athlon/  i586/  i686/  x86_64...

-- 
  ,,
 (°>   Nicolas Costes
 /|\   IUT de La Roche / Yon
( ^ )  Clé publique: http://www.keyserver.net/
 ^ ^   Musique libre: http://musique-legale.info/ - 
http://www.jamendo.com/?s=concept


pgpW5hO5spcXa.pgp
Description: PGP signature
___
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


[Vserver] Re: Container Test Campaign

2006-07-12 Thread Clément Calmels
Le mardi 11 juillet 2006 à 13:18 +0400, Kirill Korotaev a écrit :
> > Some updates on
> > http://lxc.sourceforge.net/bench/
> > 
> > New design, results of the stable version of openvz added, clearer
> > figures.
> > 
> 
> 1. are 2.6.16 OVZ results still for CFQ disk scheduler?

This tests are currently in progress... for the moment, it seems that
the anticipatory io scheduler improves performance a lot.

> 2. there is definetely something unclean in your testing as
>   vserver and MCR makes dbench faster than vanilla :))

Couldn't some test be faster inside a container than with a Vanilla? For
example if I want to dump all files in /proc, obviously inside a light
container it will be faster because /proc visibility is limited to the
container session. Just to be clear:

r3-21:~ # find /proc/ | wc -l
4213
r3-21:~ # mcr-execute -j1 -- find /proc/ | wc -l
729

I'm not sure and I'm still investigating. I'm now adding Oprofile to all
tests to have more information. If you know technical reasons that imply
different results, let me know. Help welcome!

-- 
Clément Calmels <[EMAIL PROTECTED]>

___
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


[Vserver] Problem with vservers interfering with each other on port 25

2006-07-12 Thread Kathy Kost

Has any one seen a problem similar to what I'm having?  I have a webserver 
that is running 5 different vservers, one being the root server.  They 
each have individual IP addresses as defined in 
/etc/vservers//interfaces.  I'm seeing the problem where if I 
start postfix in the root server, it will keep the other vservers from 
starting their own postfix on port 25.  If one tries to telnet to port 25 
you get a connection refused.  However, if I shut down postfix in the root 
server, postfix in the other vservers start up fine.  eth0 is defined with 
a unique IP address and all the other vservers (i.e. eth0:www, eth0:mysql, 
etc.) all have unique addresses as well as reported by ifconfig.

Anyone have any ideas?

Thanks much --

Kathy

___
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


Re: [Vserver] Problem with vservers interfering with each other on port 25

2006-07-12 Thread Daniel Hokka Zakrisson

Kathy Kost wrote:
Has any one seen a problem similar to what I'm having?  I have a webserver 
that is running 5 different vservers, one being the root server.  They 
each have individual IP addresses as defined in 
/etc/vservers//interfaces.  I'm seeing the problem where if I 
start postfix in the root server, it will keep the other vservers from 


What does root server mean? The physical host, containing all the guests?

starting their own postfix on port 25.  If one tries to telnet to port 25 
you get a connection refused.  However, if I shut down postfix in the root 
server, postfix in the other vservers start up fine.  eth0 is defined with 
a unique IP address and all the other vservers (i.e. eth0:www, eth0:mysql, 
etc.) all have unique addresses as well as reported by ifconfig.


If the above is true, that is expected behaviour. You have to bind 
services on the host to the correct IP addresses, for postfix 
smtp_bind_address in main.cf appears to be the correct option.


--
Daniel Hokka Zakrisson
GPG id: 06723412
GPG fingerprint: A455 4DF3 990A 431F FECA  7947 6136 DDA2 0672 3412
___
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


Re: [Vserver] Problem with vservers interfering with each other on port 25

2006-07-12 Thread Kathy Kost

> What does root server mean? The physical host, containing all the 
guests?

Yes.  The main system running the host OS.  root server is what 
vserver-stat reports it back as.

> If the above is true, that is expected behaviour. You have to bind 
> services on the host to the correct IP addresses, for postfix 
> smtp_bind_address in main.cf appears to be the correct option.

Ah!  That makes a lot of sense.  Thanks very much, Daniel.  I will go
and do that and I suspect that will clear things up nicely.

Kathy


___
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


[Vserver] Re: Problem with vservers interfering with each other on port 25

2006-07-12 Thread Nicolas Costes
Le Mercredi 12 Juillet 2006 20:56, Kathy Kost a écrit :
> Has any one seen a problem similar to what I'm having?  I have a webserver
> that is running 5 different vservers, one being the root server.  They
> each have individual IP addresses as defined in
> /etc/vservers//interfaces.  I'm seeing the problem where if I
> start postfix in the root server, it will keep the other vservers from
> starting their own postfix on port 25.  If one tries to telnet to port 25
> you get a connection refused.  However, if I shut down postfix in the root
> server, postfix in the other vservers start up fine.  eth0 is defined with
> a unique IP address and all the other vservers (i.e. eth0:www, eth0:mysql,
> etc.) all have unique addresses as well as reported by ifconfig.
>
> Anyone have any ideas?

Hello !

This is a typical problem with vservers : The root server has the hability to 
bind on all interfaces, unlike the guests that see only their own 
interface(s).

So, when you start a service in the root server, it is likely to bind on all 
interfaces, even those "belonging" to the guests. Then, the guests will never 
be able to bind on the same ports. Moreover, if you try to access a service 
on an ip/port that should run in a guest, it's the root server that 
responds !

To prevent this, you've got to configure all services that run on the host to 
bind to only one interface. Or, say, all the interfaces that belong to the 
host and are not affected to a guest. For example, for Samba, the smb.conf 
directive is :
  interfaces = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0
(http://samba.org/samba/docs/man/manpages-3/smb.conf.5.html)

For Cups :
  Listen 1.2.3.4

Sshd :
  ListenAddress 1.2.3.4

...etc.

Anyway, NO service should run in the root server (apart from sshd)... ;-)

Good luck.

-- 
 c'est quoi le meilleur client irc pour Linux ?
 mirc
 mirc ? le meme que sur PC ???

 - #linuxfr


pgpHd2z8vH0L5.pgp
Description: PGP signature
___
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


Re: [Vserver] Re: Problem with vservers interfering with each other on port 25

2006-07-12 Thread Kathy Kost

Thanks, Nicolas, for the reply.  I have just now and gone and bound smtp 
to their specific IP addresses and restarted postfix on all.  I can see 
your point about not wanting to run anything on the root server.  Despite 
binding all postfixes, including the root server's, the root server 
postfix still refuses connections.  I'm less concerned about that one -- 
more about the other vservers.  I will see if I can move that service onto 
a new vserver and stop running things in root.

Thanks again for the reply.

Kathy

> This is a typical problem with vservers : The root server has the hability to 
> bind on all interfaces, unlike the guests that see only their own 
> interface(s).
> 
> So, when you start a service in the root server, it is likely to bind on all 
> interfaces, even those "belonging" to the guests. Then, the guests will never 
> be able to bind on the same ports. Moreover, if you try to access a service 
> on an ip/port that should run in a guest, it's the root server that 
> responds !
> 
> To prevent this, you've got to configure all services that run on the host to 
> bind to only one interface. Or, say, all the interfaces that belong to the 
> host and are not affected to a guest. For example, for Samba, the smb.conf 
> directive is :
>   interfaces = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0
> (http://samba.org/samba/docs/man/manpages-3/smb.conf.5.html)
> 
> For Cups :
>   Listen 1.2.3.4
> 
> Sshd :
>   ListenAddress 1.2.3.4
> 
> ...etc.
> 
> Anyway, NO service should run in the root server (apart from sshd)... ;-)
> 
> Good luck.
> 
> 



___
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


[Vserver] UN - vhashify - ing

2006-07-12 Thread Roderick A. Anderson

Is there a neat trick to un-hashify a guest?

Nothing I can find on the site or using google.  Well actually I found 
one of my previous messages asking about this.


Not really sure why I'd want to do this but the-powers-that-be might 
request it.  It would probably help me understand better what vhashify 
is doing ... without going through the code.



TIA
Rod
--
___
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


[Vserver] One more problem: vserver ethernet alias

2006-07-12 Thread Kathy Kost

I posted this before but not sure it actually went to the list, being my 
first post.  

I am having troubles with a vserver (named "www") in that when I add a 6th 
IP alias to it, it will not create the interface when the entire system is 
rebooted.  And until I remove that 6th definition and reboot again, the 
Apache2 server inside of vserver www will not start up, because the 
network did not initialize correctly.  I have not had any troubles with 
adding these definitions until this time.

If I manually do an ifconfig and add the interface by hand in the root 
server, then restart the www vserver and it's Apache2 server, then it's 
happy.  I'm at a loss as to why on reboot, this 6th definition has a 
problem.

I have it defined in /etc/vserver/www/interfaces/6 and have the files dev, 
ip, and name.  The IP I'm using is unique and not conflicting with any of 
the other device aliases and the name I'm using for that interface is 8 
characters long (and shorter than some of the other ones).

If anyone has any ideas, it would be much appreciated.

Thanks again for the help --

Kathy



___
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


Re: [Vserver] One more problem: vserver ethernet alias

2006-07-12 Thread Roderick A. Anderson

Kathy Kost wrote:
I posted this before but not sure it actually went to the list, being my 
first post.  

I am having troubles with a vserver (named "www") in that when I add a 6th 
IP alias to it, it will not create the interface when the entire system is 
rebooted.  And until I remove that 6th definition and reboot again, the 
Apache2 server inside of vserver www will not start up, because the 
network did not initialize correctly.  I have not had any troubles with 
adding these definitions until this time.


What do the other 5 look like?  Same except for IP?

If I manually do an ifconfig and add the interface by hand in the root 
server, then restart the www vserver and it's Apache2 server, then it's 
happy.  I'm at a loss as to why on reboot, this 6th definition has a 
problem.


Is there anything in the www guest's /var/log/httpd/error ( or access ) 
log that seems odd.


I have it defined in /etc/vserver/www/interfaces/6 and have the files dev, 
ip, and name.  The IP I'm using is unique and not conflicting with any of 
the other device aliases and the name I'm using for that interface is 8 
characters long (and shorter than some of the other ones).


How about in /etc/sysconfig/network-scripts .  Is there by any chance a 
stray ifcfg-eth? or ifcfg-eth?:? with that IP in it.



If anyone has any ideas, it would be much appreciated.


Since I'm not up to needing to add multiple IP per guest I'm shooting in 
the dark here.  Why multiple IPs per Apache guest?  One 'webmaster' for 
several domains?
   Seems six ( unified ) guests wouldn't use all that much more disk 
space nor add much overhead verses one Apache instance running multiple 
VirtualHosts.


YMMV


Thanks again for the help --

Kathy



Rod
--
___
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


Re: [Vserver] Re: Container Test Campaign

2006-07-12 Thread Herbert Poetzl
On Wed, Jul 12, 2006 at 06:31:25PM +0200, Clément Calmels wrote:
> Le mardi 11 juillet 2006 à 13:18 +0400, Kirill Korotaev a écrit :
> > > Some updates on
> > > http://lxc.sourceforge.net/bench/
> > > 
> > > New design, results of the stable version of openvz added, clearer
> > > figures.
> > > 
> > 
> > 1. are 2.6.16 OVZ results still for CFQ disk scheduler?
> 
> This tests are currently in progress... for the moment, it seems that
> the anticipatory io scheduler improves performance a lot.
> 
> > 2. there is definetely something unclean in your testing as
> >   vserver and MCR makes dbench faster than vanilla :))

that's not really unusual ...

> Couldn't some test be faster inside a container than with a Vanilla? 

yes, they definitely can, and some very specific ones
are constantly faster regardless of how many tests
and/or setups you have ...

> For example if I want to dump all files in /proc, obviously inside a
> light container it will be faster because /proc visibility is limited
> to the container session. Just to be clear:
> 
> r3-21:~ # find /proc/ | wc -l
> 4213
> r3-21:~ # mcr-execute -j1 -- find /proc/ | wc -l
> 729
> 
> I'm not sure and I'm still investigating. I'm now adding Oprofile to all
> tests to have more information. If you know technical reasons that imply
> different results, let me know. Help welcome!

yes, the 'isolation' used in Linux-VServer already
gave that 'at first glance' strange behaviour that
some tests are 'faster' inside a guest than on the
real/vanilla system, so for us it is not really new
but probably it is still confusing, here are a few
reasons _why_ some tests are better than the 'original'

 - structures inside the kernel change, relations
   between certain structures change too, some of
   those changes cause 'better' behaviour, just
   because cache usage or memory placement is different

 - many checks walk huge lists to find a socket or
   process or whatever, some of them use hashes to
   speed up the search, the lightweight guests often
   provide faster access to 'related' structures

 - scheduler and memory management are tricky beasts
   sometimes it 'just happens' that certain operations
   and/or sequences are faster than other, although
   they give the same result

HTC,
Herbert

> -- 
> Clément Calmels <[EMAIL PROTECTED]>
> 
> ___
> Vserver mailing list
> Vserver@list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
___
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


Re: [Vserver] Re: Problem with vservers interfering with each other on port 25

2006-07-12 Thread Herbert Poetzl
On Wed, Jul 12, 2006 at 02:52:08PM -0700, Kathy Kost wrote:
> 
> Thanks, Nicolas, for the reply. I have just now and gone and bound
> smtp to their specific IP addresses and restarted postfix on all.
> I can see your point about not wanting to run anything on the root
> server. Despite binding all postfixes, including the root server's,
> the root server postfix still refuses connections. 

I'd assume that system security (more specifically
tcpwrappers or iptables) keep your postfix from
accepting connections on the host system, which 
probably is a different distro than the guests

> I'm less concerned about that one -- more about the other vservers.
> I will see if I can move that service onto a new vserver and stop
> running things in root.

improves security, simplifies administration and
avoids any clashes with guest services ...

HTH,
Herbert

> Thanks again for the reply.
> 
> Kathy
> 
> > This is a typical problem with vservers : The root server has the hability 
> > to 
> > bind on all interfaces, unlike the guests that see only their own 
> > interface(s).
> > 
> > So, when you start a service in the root server, it is likely to bind on 
> > all 
> > interfaces, even those "belonging" to the guests. Then, the guests will 
> > never 
> > be able to bind on the same ports. Moreover, if you try to access a service 
> > on an ip/port that should run in a guest, it's the root server that 
> > responds !
> > 
> > To prevent this, you've got to configure all services that run on the host 
> > to 
> > bind to only one interface. Or, say, all the interfaces that belong to the 
> > host and are not affected to a guest. For example, for Samba, the smb.conf 
> > directive is :
> >   interfaces = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0
> > (http://samba.org/samba/docs/man/manpages-3/smb.conf.5.html)
> > 
> > For Cups :
> >   Listen 1.2.3.4
> > 
> > Sshd :
> >   ListenAddress 1.2.3.4
> > 
> > ...etc.
> > 
> > Anyway, NO service should run in the root server (apart from sshd)... ;-)
> > 
> > Good luck.
> > 
> > 
> 
> 
> 
> ___
> Vserver mailing list
> Vserver@list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
___
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


Re: [Vserver] One more problem: vserver ethernet alias

2006-07-12 Thread Herbert Poetzl
On Wed, Jul 12, 2006 at 02:57:29PM -0700, Kathy Kost wrote:
> 
> I posted this before but not sure it actually went to the list, being my 
> first post.  
> 
> I am having troubles with a vserver (named "www") in that when I add a 6th 
> IP alias to it, it will not create the interface when the entire system is 
> rebooted.  And until I remove that 6th definition and reboot again, the 
> Apache2 server inside of vserver www will not start up, because the 
> network did not initialize correctly.  I have not had any troubles with 
> adding these definitions until this time.
> 
> If I manually do an ifconfig and add the interface by hand in the root 
> server, then restart the www vserver and it's Apache2 server, then it's 
> happy.  I'm at a loss as to why on reboot, this 6th definition has a 
> problem.

this basically means that the IP is not added by the
tools automatically, but it _is_ assigned to the guest
properly (otherwise apache would not be able to bind
to that, i.e. it would not work with that IP, assuming
it does :)

now, as stupid as it may sound, the most likely case
is a typo, where you basically add the 'wrong' IP,
which accidentially looks like the right one at the
first (and often second, and third glance)

of course, as you are using 'aliases' there could as
well be a collision with another alias (keep in mind
that you only see a small part of the 13char aliases,
and double check with ip from iproute2)

> I have it defined in /etc/vserver/www/interfaces/6 and have the files dev, 
> ip, and name.  The IP I'm using is unique and not conflicting with any of 
> the other device aliases and the name I'm using for that interface is 8 
> characters long (and shorter than some of the other ones).

also adding a prefix (or netmask) for each of your
IPs would not hurt (on the contrary, it would clarify
things for the network stack :)

providing the 'ip addr ls' output right after a system
restart together with the network config files of that 
guest (/etc/vserver/www/interfaces/*) and a --debug 
startup (or restart) should be sufficient to explain 
what issues you are facing ...

best,
Herbert

> If anyone has any ideas, it would be much appreciated.
> 
> Thanks again for the help --
> 
> Kathy
> 
> 
> 
> ___
> Vserver mailing list
> Vserver@list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
___
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


Re: [Vserver] UN - vhashify - ing

2006-07-12 Thread Corey Wright
On Wed, 12 Jul 2006 14:53:51 -0700
"Roderick A. Anderson" <[EMAIL PROTECTED]> wrote:

> Is there a neat trick to un-hashify a guest?

find / -type f \
| while read FILE; do
cp -av ${FILE} ${FILE}.remove-hashification
rm ${FILE}
mv ${FILE}.remove-hashification ${FILE}
  done

that's just an example, but should convey the idea well enough.

> It would probably help me understand better what vhashify 
> is doing ... without going through the code.

http://archives.linux-vserver.org/200605/0098.html
http://archives.linux-vserver.org/200605/0228.html

corey
-- 
[EMAIL PROTECTED]
___
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver