OpenVZ Command Blocking

[RTGHM]

I've been searching and can't find an answer:

OpenVZ, I spin up a virtual machine for a friend, now I want to prevent them from running bash scripts, any way to prevent that so something like "sh script.sh" doesn't execute?

It's to prevent abuse.

 

[Aldryic C'boas]

What you want is a jailed shell, not a VPS.

You may wish to re-evaluate your definition of friend if you don't trust them.

 

[RTGHM]

What you want is a jailed shell, not a VPS.

You may wish to re-evaluate your definition of friend if you don't trust them.

A friend whom has known to run abusive scripts that hog memory.

I was hoping to be able to spin up a openvz container and then set security so items can't be executed, etc.

 

[Aldryic C'boas]

Well, that's not someone I would willingly give resources to.  But preferences on acquaintances aside, you're still looking at a jailed shell rather than a full-on VPS.  General rule of thumb - if they have root, you can't really restrict what they do.

 

[RTGHM]

Well, that's not someone I would willingly give resources to.  But preferences on acquaintances aside, you're still looking at a jailed shell rather than a full-on VPS.  General rule of thumb - if they have root, you can't really restrict what they do.

Alright thanks, any quick tutorials on how to configure that on CentOS?

 

[Aldryic C'boas]

https://www.yandex.com/yandsearch?text=centos%20jailed%20shell

 

[MannDude]

JailKit may be the ticket for your needs: http://olivier.sessink.nl/jailkit/jailkit.8.html

 

[Fusl]

You also might want to take a look into user-limits with /etc/security/limits.conf

 

[Francisco]

A friend whom has known to run abusive scripts that hog memory.

I was hoping to be able to spin up a openvz container and then set security so items can't be executed, etc.

OVZ would be OK with that assuming you put a hard cap on RAM.

If he does other abusive things (DDOS, etc) then as Aldryic said, a jail is likely the best solution.

Francisco

 

[Kayaba Akihiko]

OVZ would be OK with that assuming you put a hard cap on RAM.If he does other abusive things (DDOS, etc) then as Aldryic said, a jail is likely the best solution.Francisco

If he is ddosing people you probably should get him arrested and not give him anything at all but to each their own i suppose

 

[Francisco]

If he is ddosing people you probably should get him arrested and not give him anything at all but to each their own i suppose

Very true

Francisco

 

[RTGHM]

If he is ddosing people you probably should get him arrested and not give him anything at all but to each their own i suppose

DDoSing implies more than 1 machine doing the attack, therefore it's just dosing.

He doesn't do any dosing that I'm aware of - regardless I'll keep a close eye on it. He just runs abuse, buggy scripts which hog a ton of memory and slow the server down.