|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [SPAM] Re: [Xen-users] Re: number of ips
I'm a little puzzled by this. My starting point is that I can sometimes use technology to protect against foolishness but it's much harder to protect against malice. I believe that the xen 3 limit is 3 vifs per VM. So if you create all three, with one bridge mode with an asugned ip and thee two private networks, what can user do thru ignorance or malice to break this? 1. They can reconfigure their "real IP" do a diff value on the subnet and presumably well see an error on both devices that are trying to use the VM 2. What happens if they create virtual devices based on their "real" device? Can they bind these to different IPs on the subnet? Is there any reason to expect they would do this? Can you fire your users if they are malicious? This seems as much a human issue as a technical one. On Apr 11, 2009, at 3:21 PM, Vu Pham <vu@xxxxxxxxxx> wrote: Anand Gupta wrote:Hi Eljas,My dom0 basically has 2 networks, eth0 - 172.20.x.x and eth1 - 192.168.122 .x. Now presently the domU is bound on the bridge with eth0, and which where i am concerned right now. The same would be implemented in a scene with all real ips. I checked the firewall and there is no firewall enabled on dom0. Sorry but i am still confused on how and what you are proposing here.The firewall file should be /etc/sysconfig/iptables. To se sure the firewall is on when you start your system, use "chkconfig iptables on". If your firewall has not been started, you can start it manually by "service iptables start", assuming you have CentOS or RHEL for dom0.VuOn Sat, Apr 11, 2009 at 6:34 PM, Eljas Alakulppi <Buzer@xxxxxxxxx <mailto:Buzer@xxxxxxxxx >> wrote:Like I said before, Xen doesn't add DROP rules by default, only ACCEPT (so you need to set policy to DROP. Tho, it does seem likeseting antispoof=on should take care of setting policy to DROP on at least Debian. Maybe your firewall script starts after Xen takes care of networking? I have never used Xen on CentOS, so I'm not too sureabout it's specific details).Regarding the fact that there is no IP specifed on the ACCEPT rule,what does your iptables commands in the vif script look like?Oh, and I assume you want to remove state match from the first rule (otherwise the virtual servers will not allow any new connections) &remove the second rule (allows all traffic orginating from 192.168.122.0/24 <http://192.168.122.0/24>. If there is no other match requirements, it will allow DomUs to spoof addresses from192.168.122.0/24 <http://192.168.122.0/24>). The third FORWARD ruleseems like everything gets ACCEPT'ed there. Also, please useiptables-save, iptables -L doesn't include all of the details (like-i and -o). So, to wrap it up, the iptables-save should look something like: *filter ... :FORWARD DROP [0:0] ... -A FORWARD -d 192.168.122.0/24 <http://192.168.122.0/24> -j ACCEPT #Tho, this allows spoofing between two DomUs. You could try adding-m physdev --physdev-in eth0 or whatever your external interface is... And once you start, there should be one more rule on FORWARD chain-A FORWARD -s 192.168.122.5/32 <http://192.168.122.5/32> -m physdev --physdev-in vif6.0 -j ACCEPT #or whatever the IP and vif happend to be-Eljas Alakulppi On Sat, 11 Apr 2009 14:47:45 +0300, Anand Gupta <xen.mails@xxxxxxxxx <mailto:xen.mails@xxxxxxxxx>> wrote: I tried to use the antispoof feature thinking it should do the trick. Modified /etc/xen/xend-config.sxp and modified it as follows: (network-script 'network-bridge antispoof=yes') Restarted, xen, and then checked the iptables --list. I don't see the DROP rules added. Here is iptables before start of domU*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ******************************************************************* _______________________________________________ Xen-users mailing list Xen-users@xxxxxxxxxxxxxxxxxxx http://lists.xensource.com/xen-users
|
 |
Lists.xenproject.org is hosted with RackSpace, monitoring our |