You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Instantly share code, notes, and snippets.
👽
Hackin'
Philippe Back
philippeback
👽
Hackin'
Pharophile, Hadoop Geek, Sparx Enterprise Architect Wizard, IoT Explorer
Provisioning and usage of unprivileged LXC containers via indirect login or script #blog
Provisioning and usage of unprivileged LXC containers via indirect login or script
As I've discovered, managing LXC containers is fairly straightforward, but when building out a system for provisioning out user maintained instances of NodeBB, it was imperative that unprivileged LXC containers were used, so that in the event of shell breakout from NodeBB followed by privilege escalation of the saas user, the root user in the LXC container would only be an unprivileged user on the host machine.
During the course of development, I ran into numerous blockers when it came to managing LXC containers in unexpected circumstances. Namely:
Using LXC in a subshell is not directly supported. This usually happens under one of the following two circumstances:
After switching users via su or executing lxc-* commands as another user via sudo
Executing lxc-* commands via a program, application, or script. In my case, a Node.js application.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This installation is going to require 2 servers one acts as kerberos KDC server
and the other machine is going to be client. Lets assume the FQDN's are (here
cw.com is the domain name, make a note of the domain name here):
Kerberos KDC Server: kdc.cw.com
Kerberos Client: kclient.cw.com
Important: Make sure that both systems have their hostnames properly set and
both systems have the hostnames and IP addresses of both systems in
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters