Jails improve on the concept of the traditional chroot environment in several ways. In a traditional chroot environment, processes are only limited in the part of the file system they can access.

learn more… | top users | synonyms

1
vote
2answers
142 views

System Security (PHP and others)

I have a few important documents that I keep owned by www-data (apache's user) in my /var/www/ folder. They have to be www-data because PHP will write to them at times. I also have users who access ...
0
votes
2answers
90 views

Crossplatform “jail” for an application

We currently have a variety of systems (Linux, Solarix, *BSD, HP-UX ...) on which we are not allowed to install anything into / (but I have root access. That's strange, I know). But we'd like to run ...
2
votes
1answer
529 views

What are the security implications of using allow.sysvipc in a FreeBSD jail

The man page for jail says that allow.sysvipc enables "System V primitives [to] share a single namespace across the host and jail environments..." thus "... processes within a jail would be able to ...
1
vote
1answer
688 views

Is it possible to run dhcpd3 as non-root user in a chroot jail?

I would like to run dhcpd3 from a chroot jail on Debian Lenny. At the moment, I can run it as root from my jail. Now I want to do this as non-root user (as "-u blah -t /path/to/jail" Bind option). ...
0
votes
1answer
34 views

Sending syslog from jail to host fails

I'm trying to send logs from a jail to the host system on FreeBSD 10. I think everything is setup correctly but I can't get it working. Sending logs directly from Nginx 1.7 works but not sending ...
0
votes
1answer
180 views

ports in freebsd jail fetching but not updating

I've created a jail to host my webserver/blog, but when attempting to build any port, I consistently get the message "portsnap: Directory is not writable: /usr/ports". Attached is a screen capture ...
0
votes
1answer
141 views

FreeBSD jail and patch-levels

I am a newbie server manager and trying jails. It's too hard to configure it. So I decided to use ezjail utility. It seems working, but I got an issue. When I installed my FreeBSD box, it was ...
0
votes
1answer
96 views

Centos6.4: User home directory for sftp

Currently setting up a Centos6.4 box and are wanting to jail sftp users upon login. I've been following the notes here http://www.thisisnotsupported.com/sftp-chrootjail-on-centos6. But I have one ...
0
votes
1answer
1k views

FreeNAS/FreeBSD: How to access status of ZFS volume from jail?

I am trying to set up NRPE to enable remote Nagios monitoring of a new FreeNAS 0.91 system. I mostly have this working. I can connect and inquire about basic information like number of processes, ...
0
votes
1answer
296 views

How to configure jailed apache to be accessible on the network

I have jailed apache on freebsd on a private network with ip address 192.168.100.174, I have another apache server running on the host but it is configured to listen on its other IP addresses but ...
0
votes
1answer
243 views

how limit php script to access parent host directory

I've a debian linux server with apache2.2 & php5 installed. I've created many virtual hosts on my apache server, each virtual host has a separate root directory & php is enabled for all of ...
-1
votes
1answer
87 views

Server Security: FTP and System Users

I'd be happy to get an advice about handling system users and ftp users on a Linux server (Ubuntu). Just want to do it right way. I have a sysUser.sysGroup and created virtual ftpUser.ftpGroup for ...
3
votes
0answers
1k views

SSH_ORIGINAL_COMMAND variable not getting set

I am working with two servers, both of which run FreeBSD 8.4-RELEASE-p1 and OpenSSH_6.1p1. Both servers' ssh_config files, located in /etc/ssh, are identical. Both servers are configured to allow ...
2
votes
0answers
221 views

Jail PHP to OpenBasedir or Document Root Debian

I have a VServer running with Debian Squeeze Debian Squeeze / Apache2 / FastCGI / MySQL / Froxlor. The administration of Customers, Domains and FTP Accounts are performed using Froxlor. Following ...
2
votes
0answers
68 views

Simplest & Easy Way To Jail Users

I Need Simplest & Easy Way To Jail Users in there home directories I am looking tools like " jailkit & MySecureShell " Or simple configuration to jailing users (with full help or some good ...
1
vote
0answers
18 views

Nginx: Tags in Syslog output on wrong position

I'm trying to output the logs of several Nginx servers in FreeBSD jails to the jails' host. I'm using FreeBSD 10 syslog and Nginx 1.7.10. In Nginx (in this case the hostname is web) I have set: ...
0
votes
0answers
10 views

Git server in jail: working directory in different jail

I'm setting up a FreeBSD server with five jails. Some of them are web servers with web apps. Some of those apps should be updated using git. I was now thinking about running the git server in his own ...
0
votes
0answers
723 views

SSH server in a FreeNAS jail is not accessible from the local network

I Have a FreeNAS (not sure which version - the one that uses FreeBSD 9.2) setup with a jail that I use for running various tasks. The jail has SSH service enabled in rc.conf, and I can also see the ...
0
votes
0answers
63 views

FreeBSD jail loses network connectivity after some time

I have a Jail on a FreeBSD 9.2 installation on my office network, which I use to run some cron jobs that upload and download stuff from external servers. The cron jobs are configured on the main ...
0
votes
0answers
306 views

Accessing public ip from within freebsd jail with ipf and ipnat

I'm using FreeBSD 9.3 (same issue with 9.2 and 10.0 in test VMs). I have jails running on lo1 10.0.0.x addresses. I use ipf with this config in /etc/ipf.rules: pass in quick on em0 all pass out quick ...
0
votes
0answers
269 views

FreeBSD Ezjail flavour script fails to execute

I'm having some trouble configuring jails on FreeBSD (10.0-RELEASE) with Ezjail (3.4.1). The flavour RC script does not seem to execute on first jail startup. The script is located in ...
0
votes
0answers
145 views

FreeBSD jail (ez-jail) “connect: Operation not permitted” ONLY for endpoints routable from a particular interface when jail is bound to a `bridge`

Edit I answered my original question: basically, binding the jail to a bridge interface was the problem. Now my question is, why is this the case? Is there a way to get it to work with a bridge ...