[lkml]   [2002]   [Nov]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: lan based kgdb
    Jamie Lokier <> writes:

    > Eric W. Biederman wrote:
    > > As long as the network console/debug interface includes basic a basic
    > > check to verify that the packets it accepts are from the local network.
    > > And it's outgoing packets have a ttl of one. I don't have a problem.
    > Is there a working network console? It would be _great_ to have a
    > network console to my _remote_ server, far far away on the internet.

    There are bits and pieces, and a lan based kgdb is basically the same
    problem security wise. When you allow any kind of control the security
    cannot be in the console protocol. Therefore it can only be used on
    a trusted lan and be only talk to local addresses. At the same time
    if you have two remote machines on that trusted lan you can use one
    to control the other. Knowing that a root exploit on one likely
    becomes a root exploit on both.

    And weather or not we have one at the moment, it is an active area of
    research. We just need to get a useable security model. And I think
    enforcing that the console be on a secure lan where every connected
    machine is trusted is a good first draft, at the latter.

    So I do not think this is the kind of thing that will help if you
    only have one _remote_ server, far far away on the internet, but when
    you start getting a collection of them it may help.

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:31    [W:0.020 / U:36.756 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site