Questions tagged [jail]
Jails improve on the concept of the traditional chroot environment in several ways. In a traditional chroot environment, processes are only limited in the part of the file system they can access.
116
questions
2
votes
3
answers
14k
views
Fail2ban MTA=Postfix Setting in Jail Config giving Error
In /etc/fail2ban/jail.local, when I have the MTA setting to Postfix, Fail2Ban is showing an error and is unable to start.
[DEFAULT]
ignoreip = 127.0.0.1/8
bantime = 1800
...
-1
votes
1
answer
79
views
fail2ban Jail starts but no connections are showed
I installed fail2ban on my Ubuntu server.
It seems to starts fine:
cat fail2ban.log
2023-12-07 14:55:27,758 fail2ban.server [803]: INFO --------------------------------------------------
...
0
votes
1
answer
97
views
What makes nsjail's disable_no_new_privs dangerous?
The documentation of nsjail states that disable_no_new_privs is dangerous:
--disable_no_new_privs
Don't set the prctl(NO_NEW_PRIVS, 1) (DANGEROUS)
The kernel docs point out that
For example, the ...
0
votes
1
answer
2k
views
How to keep jailed users from changing directory to parent dirs?
I've chroot users with
chroot_local_user=YES
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list
and I'm the only user in the chroot_list file. Other users log in jailed but when they go ...
2
votes
1
answer
1k
views
Use netns to bind programs to specific IP addresses
I have an IP address on my server, say, 192.168.0.3, I want to share in a net namespace, so to run apps there which will only be able to communicate to the internet using that 192.168.0.3.
I can "...
22
votes
6
answers
22k
views
OpenSSH anything like 'internal-sftp' but for SCP?
I'm running Debian stable and I'm looking to establish the following environment for users in my 'sftponly' group:
jailed
can transfer with SFTP
can transfer with SCP
cannot login interactively with ...
1
vote
1
answer
10k
views
How to move iocage jails from one ZFS pool to another?
What is the process to move iocage and all its jails from one ZFS pool to another?
I've tried the process from this post: https://www.ixsystems.com/community/threads/how-to-move-jails-between-pools....
2
votes
2
answers
2k
views
FreeBSD & Jails: Send mail through Postfix in Jail
I have FreeBSD 10.2 and I'm using several Jails, one of them has Postfix installed.
I want my other jails and my host system to use the local Postfix installation in the Jail. They should use ...
1
vote
1
answer
2k
views
Is it possible to run dhcpd3 as non-root user in a chroot jail?
I would like to run dhcpd3 from a chroot jail on Debian Lenny. At the moment, I can run it as root from my jail.
Now I want to do this as non-root user (as "-u blah -t /path/to/jail" Bind option).
...
1
vote
0
answers
1k
views
FreeNAS unable to resolve hostnames, ping of any external IP returns host's ip instead
The internal IP address of my router changed, and ever since TrueNAS has been misbehaving. None of the jails can resolve a hostname anymore. In troubleshooting this, I discovered that the client ...
6
votes
3
answers
4k
views
Is there a tool for managing FreeBSD jails that knows about ZFS?
ZFS under FreeBSD lets one assign filesystems to a jail, such that an account in the jail with the appropriate privileges can access the filesystem, create new subordinate filesystems, and so forth. ...
0
votes
1
answer
1k
views
ports in freebsd jail fetching but not updating
I've created a jail to host my webserver/blog, but when attempting to build any port, I consistently get the message "portsnap: Directory is not writable: /usr/ports".
Attached is a screen capture ...
4
votes
2
answers
16k
views
Pubkey SSH fails with "we did not send a packet, disable method" in freebsd jail
I have a FreeBSD VPS with 2 jails, each setup with ezjail (I know now that this is largely deprecated, but didn't at the time).
$ jls
JID IP Address Hostname Path
1 ...
0
votes
0
answers
101
views
ARP Connectivity Issues Between OpenMediaVault Server and BSD Jails
On my network I have two servers.
Server1 is running TrueNas(BSD) with multiple applications running in iocage jails. It's connected to the network with a 3-nic LAGG.
Server2 is an OpenMediaVault (...
0
votes
1
answer
88
views
Services whithin jails no longer accessible after upgrade to version 13.0
After upgrading a virtual FreeBSD 12.2 system to 13.0-p3, traffic to services within jails (through Apache 2.4 reverse proxy) was blocked.
This is a Hyper-V virtual server and the second one that ...
1
vote
2
answers
725
views
FreeBSD 13 PF blocking jail traffic
After upgrading my FreeBSD system from 12.2 to 13.0-p3 PF is blocking all traffic to my jails.
When disabling PF everything works fine (except from being unprotected ;))
I tried to figure out what ...
1
vote
1
answer
629
views
fail2ban does not start jails on cenots 7
SOLVED - sshd conf file was in wrong directory and with wrong extension
i have fallowed this tutorial htf and everything went smoothly, fail2ban starts nicely, i disabled selinux just in case, but ...
0
votes
1
answer
123
views
monitoring real time file access in chroot system
I was wondering if it's possible to write a shell script that:
runs chroot for a given userspec and group
monitors/intercepts system calls all processes started, and what libraries they attempt to ...
0
votes
1
answer
235
views
Is there another way to restrict SSH user other than chroot jail?
I need to create a safe environment for a foreign SSH user that has to have very restricted access to our server. That is:
can only execute commands that are allowed
can only use specific software ...
10
votes
1
answer
8k
views
SSH_ORIGINAL_COMMAND variable not getting set
I am working with two servers, both of which run FreeBSD 8.4-RELEASE-p1 and OpenSSH_6.1p1. Both servers' ssh_config files, located in /etc/ssh, are identical. Both servers are configured to allow ...
3
votes
1
answer
723
views
FreeBSD jail routing issue
I have the following setup with FreeBSD jails and VNET which is supposed to grow into a DNS core net lab setup. The jailhost and the jails are running FreeBSD 12.1. The jails are connected by epair ...
5
votes
0
answers
2k
views
FreeBSD networking setup for multiple jails - interface clones or aliases
While setting up multiple jails on a FreeBSD machine, I also (naturally) need to set up the networking for each jail. It seems to me there are two ways of achieving the same goal
setting up multiple ...
0
votes
0
answers
328
views
Static files getting requested with internal IP address prefix instead of domain-name prefix
I have a smoothly running FreeBSD box with a couple of jails running their own servers.
Nginx runs in its own jail and the main machine uses pf to redirect all http/s requests to Nginx. Nginx ...
1
vote
1
answer
242
views
Cannot stop Postgresql in FreeBsd Jail
I installed postgresql in a jail, it starts automatically after adding postgresql_enable="YES" to /etc/rc.conf), but now I can't stop it.
I tried /usr/local/etc/rc.d/postgresql stop, but I've got:
...
0
votes
1
answer
375
views
What is a recommended way of thransferring am iocage jail from one host to another
Source iocage thick jail running on FreeBSD-12.0p12
Destination FreeBSD-12.1p1
Both hosts are using zfs.
What is the recommended method to transfer an existing iocage thick jail from the source to ...
1
vote
1
answer
2k
views
Within FreeBSD jail – setting global environment vars
I need to set a systemwide environment variable (i.e. NODE_ENV=production) in a FreeBSD jail.
I did try setting it in /etc/profile, but when I sourced it
root@www:/ # source /etc/profile
I got
...
0
votes
2
answers
424
views
FreeBSD-12 IOCage modifying a jail's /root directory
What is the reason that copying .bash_profile from the host system into the /root directory of an iocage thin jail does not create a file that is visible to the root user when logged on to that jail?
...
0
votes
2
answers
2k
views
Sending syslog from jail to host fails
I'm trying to send logs from a jail to the host system on FreeBSD 10.
I think everything is setup correctly but I can't get it working.
Sending logs directly from Nginx 1.7 works but not sending ...
5
votes
0
answers
2k
views
How to mount a fuse-sshfs file system inside a FreeBSD-12.0p10 jail
I wish to mount a remote data source locally as a fuse file system. This is listed as supported by lsvfs:
lsvfs
Filesystem Num Refs Flags
-------------------------------...
22
votes
1
answer
12k
views
FreeBSD Jails or Docker instances [closed]
What are the main differences between jails on FreeBSD and Docker on Linux? Is one considerably more secure or more performant than the other? Jails are way older than Docker instances so the code ...
11
votes
2
answers
2k
views
How can I determine what permissions my user is missing for receiving a ZFS dataset?
I have a FreeNAS (11.1-U1) and a FreeBSD (11.1-RELEASE-p6) machine. On the FreeNAS I'd like to zfs receive recursive snapshots as a non-root user with delegated privileges. This appears to work well ...
0
votes
1
answer
1k
views
how to update and maintain multiple jails (ZFS & nullfs skeleton)
There are multiple ways and tools to create jails, and now that disk spaces is becoming cheaper the creation of a full jail (having already compiled a world) is just a matter of seconds:
zfs create ...
2
votes
2
answers
1k
views
FreeBSD jails access
I want to run an application inside jail so that allowed users can only connect to the jailed environment (application) and nothing else on my box.
But they need to be able to connect to the jail ...
32
votes
1
answer
23k
views
Fail2ban jail.local vs jail.conf
Does jail.local file act as an override to jail.conf or as a replacement to jail.conf?
When I was learning about Fail2Ban from tutorials, most of them usually say either to copy jail.conf to jail....
0
votes
1
answer
262
views
Does using jails in FreeBSD count as having a switch?
My network administrators don't like when I plug switch into the building network to fan-out to multiple computers. They want single link drop per physical NIC. Previously the blocked those MACs on ...
0
votes
1
answer
5k
views
fail2ban not starting jails
I'm going nuts on my live server where fail2ban is not starting jails anymore.
When i start fail2ban, everything looks fine:
fail2ban-client -x start:
2017-11-14 15:51:32,403 fail2ban.server : INFO ...
3
votes
2
answers
2k
views
A simple, step-by-step way of setting up of "jailed" SFTP-only accounts
I feel like I've gone through every SFTP/Chroot tutorial on the Internet, and not found what I am looking for (or, at least, none of them have produced the right results). Here's my specifics:
I will ...
2
votes
1
answer
2k
views
Adding a command to all existing Jailkit jails [closed]
I am running Jailkit on my server and need to add Mercurial (command hg) to all existing and future Jailkit jails.
From what I understand, creating a new jail with jk_init and a profile that includes ...
-2
votes
2
answers
3k
views
Simplest way to jail users for git [closed]
I'd like to create a couple user accounts on my server such that the users can check out a specific git repository. Ideally, the user would not be able to gain access to a shell or copy any files ...
1
vote
0
answers
64
views
BSD jail availability in the event of NFS server failure
I have some BSD systems where I am considering the use of jails for processes that should be isolated from the rest of the system.
The host system has some NFS mounts, and there is the issue that in ...
0
votes
1
answer
455
views
apache userdir jail permissions
On Debian 8 I'm running apache2 in a jailed environment using jailkit and the userdir mod. In current jail setup users can navigate into another users directory i.e
/home/jail/home/anotheruser
and ...
14
votes
1
answer
24k
views
How can I start a shell inside a jail on FreeBSD?
I have access to a a previously set up FreeBSD box with a number of jails on it. One of the jails is an SQL server, and does not have ssh enabled on it.
How can I gain access to a shell on that jail ...
2
votes
1
answer
876
views
Apache virtual hosts in jail enviroment
I have a linux server with a chroot user jail environment. Users files are kept under
/jail/username/httpdocs
and are currently resolvable under
http://IPADDRESS/~username
I need users to be ...
2
votes
1
answer
496
views
Is ssh chroot enough to allow shell access?
I'm planning to offer a backup service with limited ssh access.
The best solution i've thought of so far would be to use chroot and allow access only to certain commands like: cd,mkdir,mv,rm,rsync,...
0
votes
1
answer
2k
views
smtp sending mail as "Charlie &"
I'm trying to use ssmtp to send mail from my jails to the mail hub in one of them.
However, the from name isn't properly being renamed. The & isn't being replaced with root so I'm getting mails ...
0
votes
1
answer
202
views
jails in zfs space in freebsd 11, gives mount descfs error
Good Night, I am trying to deply a multijail environment using freebsd 11 on a OVH dedicated server.
I created the cloned interfaces and created the jail , but as soon as I try to start it tells me ...
6
votes
2
answers
911
views
Migrate FreeBSD Jails to Linux
we are running some jails in FreeBSD 10 and the decision has been made to decommission the FreeBSD server and migrate all the jails to Linux environment Red Hat 6 or 7.
Is there a straight forward ...
2
votes
1
answer
1k
views
FreeBSD jail as gateway
I am trying to set up a jail that will serve as a default gateway for some of my external clients.
I have a VIMAGE jail that has a dedicated IP address in my local network which I want to use as a ...
0
votes
1
answer
296
views
How to reuse filesystem subtree amongst multiple jails?
I have a FreeBSD 11 host, and I want to setup multiple jails in it.
Official guide suggests hard copying /usr/bin into each of the containers. Having that my jails shall be nearly identical, this ...
0
votes
1
answer
578
views
FreeNAS jail: Updating OpenSSL for certbot
I am using FreeNAS 9.3. Having created a jail for the purpose, I am trying to get nginx working together with certbot.
The basic problem is the following:
From what I gather this is because the base ...