Questions tagged [jail]

Jails improve on the concept of the traditional chroot environment in several ways. In a traditional chroot environment, processes are only limited in the part of the file system they can access.

Filter by
Sorted by
Tagged with
2 votes
3 answers
14k views

Fail2ban MTA=Postfix Setting in Jail Config giving Error

In /etc/fail2ban/jail.local, when I have the MTA setting to Postfix, Fail2Ban is showing an error and is unable to start. [DEFAULT] ignoreip = 127.0.0.1/8 bantime = 1800 ...
-1 votes
1 answer
79 views

fail2ban Jail starts but no connections are showed

I installed fail2ban on my Ubuntu server. It seems to starts fine: cat fail2ban.log 2023-12-07 14:55:27,758 fail2ban.server [803]: INFO -------------------------------------------------- ...
0 votes
1 answer
97 views

What makes nsjail's disable_no_new_privs dangerous?

The documentation of nsjail states that disable_no_new_privs is dangerous: --disable_no_new_privs Don't set the prctl(NO_NEW_PRIVS, 1) (DANGEROUS) The kernel docs point out that For example, the ...
0 votes
1 answer
2k views

How to keep jailed users from changing directory to parent dirs?

I've chroot users with chroot_local_user=YES chroot_list_enable=YES chroot_list_file=/etc/vsftpd.chroot_list and I'm the only user in the chroot_list file. Other users log in jailed but when they go ...
2 votes
1 answer
1k views

Use netns to bind programs to specific IP addresses

I have an IP address on my server, say, 192.168.0.3, I want to share in a net namespace, so to run apps there which will only be able to communicate to the internet using that 192.168.0.3. I can "...
22 votes
6 answers
22k views

OpenSSH anything like 'internal-sftp' but for SCP?

I'm running Debian stable and I'm looking to establish the following environment for users in my 'sftponly' group: jailed can transfer with SFTP can transfer with SCP cannot login interactively with ...
1 vote
1 answer
10k views

How to move iocage jails from one ZFS pool to another?

What is the process to move iocage and all its jails from one ZFS pool to another? I've tried the process from this post: https://www.ixsystems.com/community/threads/how-to-move-jails-between-pools....
2 votes
2 answers
2k views

FreeBSD & Jails: Send mail through Postfix in Jail

I have FreeBSD 10.2 and I'm using several Jails, one of them has Postfix installed. I want my other jails and my host system to use the local Postfix installation in the Jail. They should use ...
1 vote
1 answer
2k views

Is it possible to run dhcpd3 as non-root user in a chroot jail?

I would like to run dhcpd3 from a chroot jail on Debian Lenny. At the moment, I can run it as root from my jail. Now I want to do this as non-root user (as "-u blah -t /path/to/jail" Bind option). ...
1 vote
0 answers
1k views

FreeNAS unable to resolve hostnames, ping of any external IP returns host's ip instead

The internal IP address of my router changed, and ever since TrueNAS has been misbehaving. None of the jails can resolve a hostname anymore. In troubleshooting this, I discovered that the client ...
6 votes
3 answers
4k views

Is there a tool for managing FreeBSD jails that knows about ZFS?

ZFS under FreeBSD lets one assign filesystems to a jail, such that an account in the jail with the appropriate privileges can access the filesystem, create new subordinate filesystems, and so forth. ...
0 votes
1 answer
1k views

ports in freebsd jail fetching but not updating

I've created a jail to host my webserver/blog, but when attempting to build any port, I consistently get the message "portsnap: Directory is not writable: /usr/ports". Attached is a screen capture ...
4 votes
2 answers
16k views

Pubkey SSH fails with "we did not send a packet, disable method" in freebsd jail

I have a FreeBSD VPS with 2 jails, each setup with ezjail (I know now that this is largely deprecated, but didn't at the time). $ jls JID IP Address Hostname Path 1 ...
0 votes
0 answers
101 views

ARP Connectivity Issues Between OpenMediaVault Server and BSD Jails

On my network I have two servers. Server1 is running TrueNas(BSD) with multiple applications running in iocage jails. It's connected to the network with a 3-nic LAGG. Server2 is an OpenMediaVault (...
0 votes
1 answer
88 views

Services whithin jails no longer accessible after upgrade to version 13.0

After upgrading a virtual FreeBSD 12.2 system to 13.0-p3, traffic to services within jails (through Apache 2.4 reverse proxy) was blocked. This is a Hyper-V virtual server and the second one that ...
1 vote
2 answers
725 views

FreeBSD 13 PF blocking jail traffic

After upgrading my FreeBSD system from 12.2 to 13.0-p3 PF is blocking all traffic to my jails. When disabling PF everything works fine (except from being unprotected ;)) I tried to figure out what ...
1 vote
1 answer
629 views

fail2ban does not start jails on cenots 7

SOLVED - sshd conf file was in wrong directory and with wrong extension i have fallowed this tutorial htf and everything went smoothly, fail2ban starts nicely, i disabled selinux just in case, but ...
0 votes
1 answer
123 views

monitoring real time file access in chroot system

I was wondering if it's possible to write a shell script that: runs chroot for a given userspec and group monitors/intercepts system calls all processes started, and what libraries they attempt to ...
0 votes
1 answer
235 views

Is there another way to restrict SSH user other than chroot jail?

I need to create a safe environment for a foreign SSH user that has to have very restricted access to our server. That is: can only execute commands that are allowed can only use specific software ...
10 votes
1 answer
8k views

SSH_ORIGINAL_COMMAND variable not getting set

I am working with two servers, both of which run FreeBSD 8.4-RELEASE-p1 and OpenSSH_6.1p1. Both servers' ssh_config files, located in /etc/ssh, are identical. Both servers are configured to allow ...
3 votes
1 answer
723 views

FreeBSD jail routing issue

I have the following setup with FreeBSD jails and VNET which is supposed to grow into a DNS core net lab setup. The jailhost and the jails are running FreeBSD 12.1. The jails are connected by epair ...
5 votes
0 answers
2k views

FreeBSD networking setup for multiple jails - interface clones or aliases

While setting up multiple jails on a FreeBSD machine, I also (naturally) need to set up the networking for each jail. It seems to me there are two ways of achieving the same goal setting up multiple ...
0 votes
0 answers
328 views

Static files getting requested with internal IP address prefix instead of domain-name prefix

I have a smoothly running FreeBSD box with a couple of jails running their own servers. Nginx runs in its own jail and the main machine uses pf to redirect all http/s requests to Nginx. Nginx ...
1 vote
1 answer
242 views

Cannot stop Postgresql in FreeBsd Jail

I installed postgresql in a jail, it starts automatically after adding postgresql_enable="YES" to /etc/rc.conf), but now I can't stop it. I tried /usr/local/etc/rc.d/postgresql stop, but I've got: ...
0 votes
1 answer
375 views

What is a recommended way of thransferring am iocage jail from one host to another

Source iocage thick jail running on FreeBSD-12.0p12 Destination FreeBSD-12.1p1 Both hosts are using zfs. What is the recommended method to transfer an existing iocage thick jail from the source to ...
1 vote
1 answer
2k views

Within FreeBSD jail – setting global environment vars

I need to set a systemwide environment variable (i.e. NODE_ENV=production) in a FreeBSD jail. I did try setting it in /etc/profile, but when I sourced it root@www:/ # source /etc/profile I got ...
0 votes
2 answers
424 views

FreeBSD-12 IOCage modifying a jail's /root directory

What is the reason that copying .bash_profile from the host system into the /root directory of an iocage thin jail does not create a file that is visible to the root user when logged on to that jail? ...
0 votes
2 answers
2k views

Sending syslog from jail to host fails

I'm trying to send logs from a jail to the host system on FreeBSD 10. I think everything is setup correctly but I can't get it working. Sending logs directly from Nginx 1.7 works but not sending ...
5 votes
0 answers
2k views

How to mount a fuse-sshfs file system inside a FreeBSD-12.0p10 jail

I wish to mount a remote data source locally as a fuse file system. This is listed as supported by lsvfs: lsvfs Filesystem Num Refs Flags -------------------------------...
22 votes
1 answer
12k views

FreeBSD Jails or Docker instances [closed]

What are the main differences between jails on FreeBSD and Docker on Linux? Is one considerably more secure or more performant than the other? Jails are way older than Docker instances so the code ...
11 votes
2 answers
2k views

How can I determine what permissions my user is missing for receiving a ZFS dataset?

I have a FreeNAS (11.1-U1) and a FreeBSD (11.1-RELEASE-p6) machine. On the FreeNAS I'd like to zfs receive recursive snapshots as a non-root user with delegated privileges. This appears to work well ...
0 votes
1 answer
1k views

how to update and maintain multiple jails (ZFS & nullfs skeleton)

There are multiple ways and tools to create jails, and now that disk spaces is becoming cheaper the creation of a full jail (having already compiled a world) is just a matter of seconds: zfs create ...
2 votes
2 answers
1k views

FreeBSD jails access

I want to run an application inside jail so that allowed users can only connect to the jailed environment (application) and nothing else on my box. But they need to be able to connect to the jail ...
32 votes
1 answer
23k views

Fail2ban jail.local vs jail.conf

Does jail.local file act as an override to jail.conf or as a replacement to jail.conf? When I was learning about Fail2Ban from tutorials, most of them usually say either to copy jail.conf to jail....
0 votes
1 answer
262 views

Does using jails in FreeBSD count as having a switch?

My network administrators don't like when I plug switch into the building network to fan-out to multiple computers. They want single link drop per physical NIC. Previously the blocked those MACs on ...
0 votes
1 answer
5k views

fail2ban not starting jails

I'm going nuts on my live server where fail2ban is not starting jails anymore. When i start fail2ban, everything looks fine: fail2ban-client -x start: 2017-11-14 15:51:32,403 fail2ban.server : INFO ...
3 votes
2 answers
2k views

A simple, step-by-step way of setting up of "jailed" SFTP-only accounts

I feel like I've gone through every SFTP/Chroot tutorial on the Internet, and not found what I am looking for (or, at least, none of them have produced the right results). Here's my specifics: I will ...
2 votes
1 answer
2k views

Adding a command to all existing Jailkit jails [closed]

I am running Jailkit on my server and need to add Mercurial (command hg) to all existing and future Jailkit jails. From what I understand, creating a new jail with jk_init and a profile that includes ...
-2 votes
2 answers
3k views

Simplest way to jail users for git [closed]

I'd like to create a couple user accounts on my server such that the users can check out a specific git repository. Ideally, the user would not be able to gain access to a shell or copy any files ...
1 vote
0 answers
64 views

BSD jail availability in the event of NFS server failure

I have some BSD systems where I am considering the use of jails for processes that should be isolated from the rest of the system. The host system has some NFS mounts, and there is the issue that in ...
0 votes
1 answer
455 views

apache userdir jail permissions

On Debian 8 I'm running apache2 in a jailed environment using jailkit and the userdir mod. In current jail setup users can navigate into another users directory i.e /home/jail/home/anotheruser and ...
14 votes
1 answer
24k views

How can I start a shell inside a jail on FreeBSD?

I have access to a a previously set up FreeBSD box with a number of jails on it. One of the jails is an SQL server, and does not have ssh enabled on it. How can I gain access to a shell on that jail ...
2 votes
1 answer
876 views

Apache virtual hosts in jail enviroment

I have a linux server with a chroot user jail environment. Users files are kept under /jail/username/httpdocs and are currently resolvable under http://IPADDRESS/~username I need users to be ...
2 votes
1 answer
496 views

Is ssh chroot enough to allow shell access?

I'm planning to offer a backup service with limited ssh access. The best solution i've thought of so far would be to use chroot and allow access only to certain commands like: cd,mkdir,mv,rm,rsync,...
0 votes
1 answer
2k views

smtp sending mail as "Charlie &"

I'm trying to use ssmtp to send mail from my jails to the mail hub in one of them. However, the from name isn't properly being renamed. The & isn't being replaced with root so I'm getting mails ...
0 votes
1 answer
202 views

jails in zfs space in freebsd 11, gives mount descfs error

Good Night, I am trying to deply a multijail environment using freebsd 11 on a OVH dedicated server. I created the cloned interfaces and created the jail , but as soon as I try to start it tells me ...
6 votes
2 answers
911 views

Migrate FreeBSD Jails to Linux

we are running some jails in FreeBSD 10 and the decision has been made to decommission the FreeBSD server and migrate all the jails to Linux environment Red Hat 6 or 7. Is there a straight forward ...
2 votes
1 answer
1k views

FreeBSD jail as gateway

I am trying to set up a jail that will serve as a default gateway for some of my external clients. I have a VIMAGE jail that has a dedicated IP address in my local network which I want to use as a ...
0 votes
1 answer
296 views

How to reuse filesystem subtree amongst multiple jails?

I have a FreeBSD 11 host, and I want to setup multiple jails in it. Official guide suggests hard copying /usr/bin into each of the containers. Having that my jails shall be nearly identical, this ...
0 votes
1 answer
578 views

FreeNAS jail: Updating OpenSSL for certbot

I am using FreeNAS 9.3. Having created a jail for the purpose, I am trying to get nginx working together with certbot. The basic problem is the following: From what I gather this is because the base ...