Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
KVM/QEMU: Same root partition, multiple read-only guests?
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
1clue
Advocate
Advocate


Joined: 05 Feb 2006
Posts: 2562

PostPosted: Mon Jan 06, 2014 11:23 pm    Post subject: KVM/QEMU: Same root partition, multiple read-only guests? Reply with quote

Hi,

I'm finding a need for multiples of a virtual server and would like to know viability.

I'm trying to put together a somewhat secure network. I have 4 subnets planned, and not all of them can see each other.

The biggest example of duplicated services is for DNS and DHCP. I need these services for all 4 subnets, but don't want the less secure networks to know about the more secure networks in any way.

The basic network plan:

  1. DMZ: Not totally open, but everything that's open is here. Hooked to the external router.
  2. NAT: A plain old home router for guests, wireless and digital cockroaches. Hooked to the external router.
  3. DMZ: Hooked to the external router. DMZ knows where the public side is, but does not have any other information.
  4. Private: Hooked to DMZ. No access initiated from outside, all outbound access allowed specifically by rules.


So here's what I have in mind:

  1. Build a VM with DHCP/DNS on it.
  2. The main VM has read/write access to root partition but does not serve DHCP or DNS
  3. Each actually used server has read-only access to everything but logging, service-specific directories and maybe /tmp.
  4. I'd like a way for these systems to not have access to a compiler.
  5. Is it feasible to have a Gentoo build that has multiple target roots, one for the build system and one which has only specific software on it, and have the build system know about both for reasonably simple updates?


Thanks.
Back to top
View user's profile Send private message
1clue
Advocate
Advocate


Joined: 05 Feb 2006
Posts: 2562

PostPosted: Tue Jan 07, 2014 3:24 am    Post subject: Reply with quote

What I'm thinking is something akin to a chroot, but for a VM guest rather than just a chroot. One master with full access, then multiple read-only guests working off the limited edition.

I guess that sort of answers my question, I could build my packages, mount my read-only model, copy files from the appropriate packages, and then run the guests.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum