2

Background:

I want to try unprivileged lxc containers a try on my small web server (hosting 2-4 users). Since the server is shared among friends, we decided to separate our services from the machine using lightweight containers. We envision that each user will run a host of unprivileged containers for each service of his with an option, that selected services/lxc containers will be started upon system start.

Under normal circumstances, one would simply use setuid and setgid stanza to run lxc containers in context of each user. Unfortunately it doesn't work; I suspect it has something to do with the subuid requirements of the unprivileged containers. Commands such as sudo -u <user> -- lxc-autostart or su -l <user> -c lxc-autostart may not change the subuid properties of the calling entity (which is root in case of upstart).

So far, the only way of calling unprivileged containers from another account I found is by means of ssh <user>@localhost lxc-autostart.

The question rephrased

I can put such invocation on upstart script, but for it to work I need to generate public certificate for root, and ensure that <user> will accept automatic logging from upstarts' root. Is it secure?

The host is 64bit Ubuntu 14.04; it already uses ssh. As for Ubuntu's best practices, there is no password for root and root has empty .ssh/authorized_keys.

No <user> with automatic lxc containers uses ecryptfs (A.K.A. encrypted home), since it would be useless anyway on such setup.

Improve this question
4
  • 2
    I do not see any security risk in it, since it is almost the same as the su - <user> -c (you would need to compromise root's account to make use of the key as its permissions are 0400). But if you want an extra security, on the authorized_keys file add from="127.0.0.1" at the end of root's public key to avoid it being used from outside your box.
    – NuTTyX
    Jan 8, 2015 at 18:49
  • Wouldn't cron be a much simpler solution? A script in the intended user's crontab to check if the service is running that starts the job if it is not live.
    – DarkLighting
    Jan 8, 2015 at 19:44
  • @DarkLighting No. This is a remote server, and the user usually will not be logged in interactively. (Actually we will use Puppet for the configuration, so in fact the user might never log in interactively)
    – Adam Ryczkowski
    Jan 8, 2015 at 20:02
  • 2
    @AdamRyczkowski crontab does not need a user to be logged in. Actually, what it does is just the opposite. Cron was created to automate system maintenance and administration jobs and, from what i could understand, what you want it to do is an administrative job.
    – DarkLighting
    Jan 8, 2015 at 20:09

1 Answer 1

Reset to default
1

No, for the following reason: root could patch sshd to always try root's authorized_keys file as well as its own.

Of course if root's private key gets stolen you have a bad day. Don't allow that. You would be much happier if root's private key only exists in /root on the server.

If someone can become root they can steal it but that's of no account because they can do far worse. For example, patch sshd to take a hardcoded authorized key for any account.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.