"A single swap file or partition may be up to 128 MB in size. [...] [I]f you need 256 MB of swap, you can create two 128-MB swap partitions." (M. Welsh & L. Kaufman, Running Linux, 2e, 1996, p. 49)
@Not_Oles said: I haven't used Docker very much. From @yoursunny I heard that adding people to the docker group is equivalent to giving them root on the server. If you Google search "docker group privilege escalation" there seems to be a lot of information available.
As you said, I searched "Docker Privilege Escalation" on Google and found that as you mentioned, members of the Docker group do have a way to escape the container and obtain root privileges on the host with just a few simple commands. This is the first time I've known about such a vulnerability, which is a bit scary. I understand your concerns. Configuring the Docker environment in a VM myself should be safe, right?
I'm much less familiar with Docker than I would like. So, unfortunately, I cannot answer your question about whether configuring the Docker environment [inside a Qemu-KVM virtual machine] would be safe.
I have asked the guys using the i9-9900K if it is okay to add you over there. Assuming they say it's okay to add you, it might be fun for you to try installing Docker over there and step through the privilege escalation. (Which wouldn't make any difference because on the i9-9900K you already would have sudo.)
I can imagine a server with just Docker containers for all the users. Maybe users could have multiple containers. I don't know if anyone is doing that.
You might want to consider working with the command line directly on the node, at least for a little while. Fewer people work that way nowadays, but raw command line is how most server tasks used to be done. Perhaps there is some benefit to learning a little of the traditional methods before they are gone? An objection many people offer against working directly on the node is that others can see your work. The same objection is voiced against LXC. I have never tried it, but I hear it is "trivial" for root to compromise a running Qemu VM. I wonder whether this is correct. Some day, maybe I will try to learn more about it.
I liked the blockchain verification mentioned on your website. That's another new thing for me. I have heard of blockchain in connection with crypto, but your website is the first time I have seen blockchain verification in connection with a blog website and comments. Maybe it would save a lot of drama if MetalVPS accounts were set up with blockchain verification.
I like all the fun stuff you are doing! Thank you!
Free MetalVPS Intel i9-13900 Traditional Shell Account! Make Your Own VPSes!
Somehow, I find it hard to reconcile "traditional shell account" with "make your own VPSes!"
Agreed! Of course, to me, I want to make the VPS, and then work inside it with a shell account. So, in my primitive concept, a VM is just a shell account inside a different type of shell. 🐢
Where I have trouble is that most everyone else seems to want to install Windows and play games. Where I had imagined a heaven to which people could ascend via ssh and thereby escape the closed source hell of their local machine, it turns out that my monthly payments seem indirectly supporting Microsoft instead of open source.
Luckily there are amazingly wonderful guys who come aboard from time to time.
That said, "make your own VPSes!" is a brave (but risky!) injunction
Why make a VPS when you have the option to work directly on the node command line? 😱
Just a suggestion as I see lots of people just stating that they want to learn creating VMs (without being any more specific). Why not start with running FreeDOS in a VM, and then maybe move up to NetBSD or something similar? Should be a lot less resource intensive and a very good learning opportunity.
Another idea would be to set some reasonable limits in /etc/security/limits.conf that would discourage memory-heavy long-running processes, but likely wouldn't affect normal shell usage.
@Not_Oles said:
Is anyone noticing reduced performance? We were looking at load averages about 8, and I don't recall anyone mentioning any performance issues. How is the server working for you now, with the load average at 16 and kswapd0 running at 50%?
Does anybody object to my not redacting usernames? Unless someone objects, I will stop redacting usernames.
Yes yes, I object to redacting usernames of the top 20 most resource users. It is a free service you are providing and since they are not paying for privacy, I do not see a need to redact usernames, given they are mostly similar to what it is on this forum.
I just remembered i owe you a load monitoring solution. I'll try to write up a simple script you can run by cron that will check the load every XX minutes/hours and save it to file. I can also add the option to kill the process if it goes beyond a certain cpu or memory limit (if you need it) so do let me know on that.
@somik said: See the line -v /var/run/docker.sock:/var/run/docker.sock ? That is mounting the docker socket inside the container. If you do not do it for all your containers, I don't see any issues...
Thank you for the clarification. I understand now that the vulnerability occurs when the Docker socket is mounted inside the container, which is typically done for Docker management containers like Portainer. I will make sure not to mount the Docker socket inside my containers to avoid this issue. I appreciate your help and guidance on this matter😮
In addition, I would like to ask you: theoretically, can mount the Docker socket inside containers be completed by the container administrator independently without the consent of the host administrator? I think if so, it still does not seem very safe.🤔
@somik said: I just remembered i owe you a load monitoring solution. I'll try to write up a simple script you can run by cron that will check the load every XX minutes/hours and save it to file. I can also add the option to kill the process if it goes beyond a certain cpu or memory limit (if you need it) so do let me know on that.
Thanks for your help! As much as I appreciate your help, please let me release you from any notion of owing me something.
I do not feel a need for "auto killing" of processes. Probably I will regret saying that someday when there is a huge and irredeemably evil process on the loose, wrecking everything.
I've been using nethogs a little bit today. I didn't find a "run once and print to standard output" option: accumulate total usage by process for x seconds, print to standard output. I didn't see anything about IPv6 either. Maybe I missed something.
@OpenSourceUser said:
Hi @Not_Oles im a 14 year old student in USA who wants to try metalvps for creating Qemu-KVM VMs. I also saw some posts about new i9-9900k server i would like to try that server too for gpu passthrough (vGPU) but i need sudo permissions for that gpu passthrough thing. My ed25519 SSH key ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIATeMYw8cEikz3WblEkWXuibINQw9kDwigwA4FcTYDzX eddsa-key-20230505
Best wishes! John
Hey John!
Thanks for your request!
Any chance I could talk with your parents? Can you please ask them to email me at the address on my LES profile? Thanks again!
@Not_Oles said:
Thanks for your help! As much as I appreciate your help, please let me release you from any notion of owing me something.
I do not feel a need for "auto killing" of processes. Probably I will regret saying that someday when there is a huge and irredeemably evil process on the loose, wrecking everything.
I'll keep the option there where you can set the "limit". You can set to very high so it doesn't interfere with regular operations.
@Not_Oles said:
I've been using nethogs a little bit today. I didn't find a "run once and print to standard output" option: accumulate total usage by process for x seconds, print to standard output. I didn't see anything about IPv6 either. Maybe I missed something.
I normally use vnstat for network monitoring but that's for whole server, not per process either.
In my experience, high network usage is almost always due to torrents. So if a process is using a lot of resources both up AND down, it's probably for torrenting.
@SySSamin said:
Hi @Not_Oles
I want to get MetalVPS for Server Hosting
SSH key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMXxrJ2226g8KPky2Zg1PEjjIsRUXF/aI9+HGun5tkdv eddsa-key-20230429
Hello SysSamin,
can you tell us a little bit about yourself and what you want to use MetalVPS for?
I'm helping @Not_Oles out with MetalVPS, as an volunteer system administrator, due to the increase in users.
Hello. So I want to use Metal VPS for Testing a Minecraft Server like how to make it put plugins and use it. since my laptop is low end I can't do that.
Thanks for your request! Your request is welcome, and I am trying to consider it carefully.
I wish you had included more information about yourself and your education and your experience. Also, I wonder about what brand and model laptop you are using. Could you please share more details?
I wonder about the plugin you want to make for Minecraft. Could you share specific details about what you want your plugin to do?
For somebody like me, who is clueless™ about Windows, Minecraft, and Java, Google found me this 2020 guide to Minecraft plugin development. Is this guide okay, or is there another guide which you would recommend?
How can I better understand details about you and about what you want to do on the server?
Best wishes!
Tom
Hello again, So my Laptop Model is HP ProBook 450 G3. I am learning about making Minecraft servers and I am not making a Plugin
I am gonna learn how to use the Public Plugins. From Websites and test it.
Thanks for your message. Thanks for telling us about your laptop. I'm clueless™ about Minecraft. I heard it runs on Java. Awhile back I had a friend who wanted to make sure our server ran okay under heavy load. So he asked another friend to install Minecraft. And the load was heavy! Sorry, but I do not believe that even an i9-13900 is powerful enough to run multiple Minecraft servers with guys experimenting with plugins. Maybe I am wrong. Maybe someone can explain to me.
Also, as I said before
I wish you had included more information about yourself and your education and your experience.
So I think I have to say no to your request because of (1) too heavy usage and (2) no information about yourself, your education, and your experience.
Please stay with us here in this thread and all around the other threads on LES. Please contribute questions and answers. Probably you can find here at LES a great solution to your need for a Minecraft server. I hope so!
Okay, no worries! When I get a chance, I will fix the /home directory.
When you have time, you might be interested in the differences between useradd and adduser. Also, we need to add @NodeSeek用户123 's ssh key, of which I have a copy.
@Not_Oles@dinopotato
I am utterly surprised to hear that you plan to add me to the sudo group🤯. This is an enormous show of trust in me. I feel both thrilled and deeply pressured, fearful of failing to live up to this trust. Given that I clearly know I am still a novice, I will not use sudo commands unless I have a clear understanding of the consequences and how to undo them. Before executing any sudo commands that I am uncertain of, I will seek your opinions to ensure I do not mess things up. 😊
@Exinjh Would you kindly send me a PM about who you really are, where you really are, what you are running on the server, and what you are trying to accomplish. It's fine to joke around, but, really, if you want to keep your account, it's time to play it straight.
Hi, @Not_Oles. I want to get an account in your MetalVPS. I'm 17 years old guy from France. I used Linux only on VMware - Alpine Linux. It's my favourite Linux distro! I want to try creating QEMU-KVM virtual machines, try creating LXC containers and proot-environments. I have nice Linux skill. Here's my SSH key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIENxEGH5VonVLWw6nyrfa9idt/mPixNsYMjdrz3iT8oX eddsa-key-20230427. I hope I'll be accepted.
How can I continue giving you opportunities to show who you really are? You seem not to want to tell us, and not to tell me, even privately.
(I will not run benchmarks anymore, and decrease vCPUs of my VM.)
This misses the point! It's certainly okay to run benchmarks and to do other heavy stuff. I keep trying to say that the way to do heavy stuff is to post here about what you are doing, how, why, when, how long.
Also, thanks for unsuspending my account!
You're welcome! But your account seems to have been suspended again.
Best wishes!
I'm from France, I had some Linux Course, and I have weak laptop. I running there Windows 10 Lite, Windows XP SP3 Professional and Windows For Workgroups 3.11. But soon i'll try some really old Linux distro! Also, I'll share benchmark results! So, for some time I can use many performance. I'll just run benchmarks again. I will run benchmarks today or tomorrow. But it will not be so long. Why i running benchmarks? I want to show you, guys power of MetalVPS VMs! In Windows 10 Lite VM, I running Chrome, DosBox and other things.
Hi ！@Not_Oles@dinopotato
Thank you for your work!❤️ I found that I can log in to fsn.metalvps.com , but I cannot log in to 65.21.134.121 with the same port, username, SSH key and corresponding passphrase（I have confirmed it multiple times. ）🤔 . I don't seem to be able to solve this problem on my own. Sorry to trouble you.🫡 This is mine ssh public key :
Comments
Somehow, I find it hard to reconcile "traditional shell account" with "make your own VPSes!"
That said, "make your own VPSes!" is a brave (but risky!) injunction
"A single swap file or partition may be up to 128 MB in size. [...] [I]f you need 256 MB of swap, you can create two 128-MB swap partitions." (M. Welsh & L. Kaufman, Running Linux, 2e, 1996, p. 49)
Hi @NodeSeek用户123!
I'm much less familiar with Docker than I would like. So, unfortunately, I cannot answer your question about whether configuring the Docker environment [inside a Qemu-KVM virtual machine] would be safe.
I have asked the guys using the i9-9900K if it is okay to add you over there. Assuming they say it's okay to add you, it might be fun for you to try installing Docker over there and step through the privilege escalation. (Which wouldn't make any difference because on the i9-9900K you already would have sudo.)
I can imagine a server with just Docker containers for all the users. Maybe users could have multiple containers. I don't know if anyone is doing that.
You might want to consider working with the command line directly on the node, at least for a little while. Fewer people work that way nowadays, but raw command line is how most server tasks used to be done. Perhaps there is some benefit to learning a little of the traditional methods before they are gone? An objection many people offer against working directly on the node is that others can see your work. The same objection is voiced against LXC. I have never tried it, but I hear it is "trivial" for root to compromise a running Qemu VM. I wonder whether this is correct. Some day, maybe I will try to learn more about it.
I liked the blockchain verification mentioned on your website. That's another new thing for me. I have heard of blockchain in connection with crypto, but your website is the first time I have seen blockchain verification in connection with a blog website and comments. Maybe it would save a lot of drama if MetalVPS accounts were set up with blockchain verification.
I like all the fun stuff you are doing!
Thank you!
Best!
Tom
MetalVPS
Agreed! Of course, to me, I want to make the VPS, and then work inside it with a shell account. So, in my primitive concept, a VM is just a shell account inside a different type of shell. 🐢
Where I have trouble is that most everyone else seems to want to install Windows and play games. Where I had imagined a heaven to which people could ascend via ssh and thereby escape the closed source hell of their local machine, it turns out that my monthly payments seem indirectly supporting Microsoft instead of open source.
Luckily there are amazingly wonderful guys who come aboard from time to time.
Why make a VPS when you have the option to work directly on the node command line? 😱
MetalVPS
Just a suggestion as I see lots of people just stating that they want to learn creating VMs (without being any more specific). Why not start with running FreeDOS in a VM, and then maybe move up to NetBSD or something similar? Should be a lot less resource intensive and a very good learning opportunity.
Another idea would be to set some reasonable limits in
/etc/security/limits.confthat would discourage memory-heavy long-running processes, but likely wouldn't affect normal shell usage.Hi Guys!
Please take a look at the difference between yesterday's and today's bandwidth. What causes that difference? Any ideas? Thanks!
Tom
MetalVPS
@NgocNguyen8372 Hello! Please tell us about what you are running on the server. Please include details about:
Operating System
Software
Memory (RAM) usage
CPU usage
What you are trying to accomplish with your VPS
Thanks very much! Best wishes!
Tom
MetalVPS
@Not_Oles said:
I added
i am thinking about making a browser that's have virusproof based on MetalVPS, also making proxmox for me:)
Yes yes, I object to redacting usernames of the top 20 most resource users. It is a free service you are providing and since they are not paying for privacy, I do not see a need to redact usernames, given they are mostly similar to what it is on this forum.
I just remembered i owe you a load monitoring solution. I'll try to write up a simple script you can run by cron that will check the load every XX minutes/hours and save it to file. I can also add the option to kill the process if it goes beyond a certain cpu or memory limit (if you need it) so do let me know on that.
Somik.org - Server admins cheat codes
Are you sure you added him?
MetalVPS
Thank you for the clarification. I understand now that the vulnerability occurs when the Docker socket is mounted inside the container, which is typically done for Docker management containers like Portainer. I will make sure not to mount the Docker socket inside my containers to avoid this issue. I appreciate your help and guidance on this matter😮
In addition, I would like to ask you: theoretically, can mount the Docker socket inside containers be completed by the container administrator independently without the consent of the host administrator? I think if so, it still does not seem very safe.🤔
Thanks for your help! As much as I appreciate your help, please let me release you from any notion of owing me something.
I do not feel a need for "auto killing" of processes. Probably I will regret saying that someday when there is a huge and irredeemably evil process on the loose, wrecking everything.
I've been using
nethogsa little bit today. I didn't find a "run once and print to standard output" option: accumulate total usage by process for x seconds, print to standard output. I didn't see anything about IPv6 either. Maybe I missed something.Thanks again! Best wishes!
MetalVPS
Yeah i think it's just didnt in home dir
Hey John!
Thanks for your request!
Any chance I could talk with your parents? Can you please ask them to email me at the address on my LES profile? Thanks again!
What have you read about GPU passthrough?
Thanks again!
Tom
MetalVPS
I'll keep the option there where you can set the "limit". You can set to very high so it doesn't interfere with regular operations.
I normally use vnstat for network monitoring but that's for whole server, not per process either.
In my experience, high network usage is almost always due to torrents. So if a process is using a lot of resources both up AND down, it's probably for torrenting.
Somik.org - Server admins cheat codes
Hi @SySSamin!
Thanks for your message. Thanks for telling us about your laptop. I'm clueless™ about Minecraft. I heard it runs on Java. Awhile back I had a friend who wanted to make sure our server ran okay under heavy load. So he asked another friend to install Minecraft. And the load was heavy! Sorry, but I do not believe that even an i9-13900 is powerful enough to run multiple Minecraft servers with guys experimenting with plugins. Maybe I am wrong. Maybe someone can explain to me.
Also, as I said before
So I think I have to say no to your request because of (1) too heavy usage and (2) no information about yourself, your education, and your experience.
Please stay with us here in this thread and all around the other threads on LES. Please contribute questions and answers. Probably you can find here at LES a great solution to your need for a Minecraft server. I hope so!
Best wishes and kindest regards,
Tom
MetalVPS
@Not_Oles could you please grant me access to the server as well for testing?
Somik.org - Server admins cheat codes
Okay, no worries! When I get a chance, I will fix the /home directory.
When you have time, you might be interested in the differences between
useraddandadduser. Also, we need to add @NodeSeek用户123 's ssh key, of which I have a copy.So, please let me fix @NodeSeek用户123 's situation.
If you want to try adding another user, please add me as
Here's my key:
notoles.ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILySvSdulbZ4XG4K333YOoFbcwoo6ythPBOf175OIBfA chronos@localhost
Thanks so much for helping! I really appreciate it!
MetalVPS
@Not_Oles@dinopotato
I am utterly surprised to hear that you plan to add me to the sudo group🤯. This is an enormous show of trust in me. I feel both thrilled and deeply pressured, fearful of failing to live up to this trust. Given that I clearly know I am still a novice, I will not use sudo commands unless I have a clear understanding of the consequences and how to undo them. Before executing any sudo commands that I am uncertain of, I will seek your opinions to ensure I do not mess things up. 😊
Try this command as root:
du -hs /home/*It'll show you the usage per user in a easy to understand way
Somik.org - Server admins cheat codes
Hi @NodeSeek用户123 !
With wonderful help from @dinopotato we added you to the i9-9900K server including the sudo group there.
Please try logging in (using your same ssh key that works for fsn.metalvps.com):
ssh nodeseek用户[email protected] -p 42365 [Please note lowercase "n".]
ssh nodeseek用户123@2a01:4f9:3b:425b::2 -p 42365
Your password is in a file in your home directory.
Please let us know if you can get in and also if sudo works for you.
Thanks again to @dinopotato for helping!
Best!
Tom
MetalVPS
Got it! Thanks! The directory that is proposed to be deleted uses 1.2T.
MetalVPS
wowza! My personal computer does not even use half as much!
The all seeing eye sees everything...
Hi!
Access to fsn granted.
kvm group membership added.
Please try
ssh [email protected] -p 42365. Should work on IPv4 or IPv6.A potential issue is . . . nobody has sudo on fsn.
Thanks for helping!
Best!
Tom
MetalVPS
I'm from France, I had some Linux Course, and I have weak laptop. I running there Windows 10 Lite, Windows XP SP3 Professional and Windows For Workgroups 3.11. But soon i'll try some really old Linux distro! Also, I'll share benchmark results! So, for some time I can use many performance. I'll just run benchmarks again. I will run benchmarks today or tomorrow. But it will not be so long. Why i running benchmarks? I want to show you, guys power of MetalVPS VMs! In Windows 10 Lite VM, I running Chrome, DosBox and other things.
Hi ！@Not_Oles@dinopotato
Thank you for your work!❤️ I found that I can log in to fsn.metalvps.com , but I cannot log in to 65.21.134.121 with the same port, username, SSH key and corresponding passphrase（I have confirmed it multiple times. ）🤔 . I don't seem to be able to solve this problem on my own. Sorry to trouble you.🫡 This is mine ssh public key :
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPNnK+sbUmMJyhrvJgBMWYDkJ+WZjLBHq+28z9GnoY4v
@dinopotato
I seem to have noticed the problem: my VPS username is not "Nodeseek用户123", but starts with "nodeseek用户123" with a lowercase "n".😮
But when I tried to ssh to 65.21.134.121, I confirmed that the username is nodeseek user 123, but the authentication still failed
1. I am running windows 11
2. I am still using VMware
3. 10GB ram
4. 5 cpu
5. Just wanna run vm stuff
Tell us more about the "VM stuff" you are running.
The all seeing eye sees everything...