virtualization: UML

[blu at vl.com (Tom Metro)]

Derek Atkins wrote:
>Rich Braun wrote:
>> The reason is security.
>> I'd re-think this if I learned a good way to implement these as
>> virtual servers with no ability to gain root access to the
>> underlying filesystems.
> 
> VMware doesn't work?  If you run your mail server as a VM Guest
> then someone who breaks into the mail server still can't usurp the
> VMWare controls and get to the physical disks.

There's a two-part article series on doing exactly this with User Mode 
Linux in the current and prior issues of Linux Journal. In it the author 
demonstrates setting up a UML virtualized server to run Bind, and 
illustrates how the guest can be tightly contained through the use of an 
iptables bridge that restricts the inbound and outbound network access.

On a general purpose server you'd never bother limiting outbound access, 
because it would be too inconvenient, but if the server is dedicated to 
running one service, that becomes practical. In addition, if that guest 
is compromised, even gaining root access within it can't change the 
software firewall rules set on the host.

The impression I got from the article was that it was also fairly easy 
to set up UML - particularly on Debian. As I recall it isn't as 
efficient as some of the other virtualization technologies, but it also 
seems simpler and doesn't have specialized hardware requirements (like, 
for example, the Virtual Iron solution), and isn't proprietary (like 
VMWare).

It'd be great to find someone to speak on UML for a future BLU meeting.

  -Tom

-- 
Tom Metro
Venture Logic, Newton, MA, USA
"Enterprise solutions through open source."
Professional Profile: http://tmetro.venturelogic.com/

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.