Questions tagged [jail]
Jails improve on the concept of the traditional chroot environment in several ways. In a traditional chroot environment, processes are only limited in the part of the file system they can access.
117
questions
0
votes
0
answers
32
views
Could not find a package configuration file provided by "PkgConf"
I'm trying to build a project using cmake
I use command ccmake and below is the output :
CMake Version 3.26.1
of the following names:
PkgConfConfig.cmake
pkgconf-config.cmake
Add the ...
- 1
-1
votes
1
answer
94
views
fail2ban Jail starts but no connections are showed
I installed fail2ban on my Ubuntu server.
It seems to starts fine:
cat fail2ban.log
2023-12-07 14:55:27,758 fail2ban.server [803]: INFO --------------------------------------------------
...
0
votes
1
answer
204
views
What makes nsjail's disable_no_new_privs dangerous?
The documentation of nsjail states that disable_no_new_privs is dangerous:
--disable_no_new_privs
Don't set the prctl(NO_NEW_PRIVS, 1) (DANGEROUS)
The kernel docs point out that
For example, the ...
- 143
2
votes
1
answer
2k
views
Use netns to bind programs to specific IP addresses
I have an IP address on my server, say, 192.168.0.3, I want to share in a net namespace, so to run apps there which will only be able to communicate to the internet using that 192.168.0.3.
I can "...
- 131
1
vote
0
answers
2k
views
FreeNAS unable to resolve hostnames, ping of any external IP returns host's ip instead
The internal IP address of my router changed, and ever since TrueNAS has been misbehaving. None of the jails can resolve a hostname anymore. In troubleshooting this, I discovered that the client ...
- 111
0
votes
0
answers
108
views
ARP Connectivity Issues Between OpenMediaVault Server and BSD Jails
On my network I have two servers.
Server1 is running TrueNas(BSD) with multiple applications running in iocage jails. It's connected to the network with a 3-nic LAGG.
Server2 is an OpenMediaVault (...
- 58
0
votes
1
answer
95
views
Services whithin jails no longer accessible after upgrade to version 13.0
After upgrading a virtual FreeBSD 12.2 system to 13.0-p3, traffic to services within jails (through Apache 2.4 reverse proxy) was blocked.
This is a Hyper-V virtual server and the second one that ...
- 21
2
votes
1
answer
767
views
fail2ban does not start jails on cenots 7
SOLVED - sshd conf file was in wrong directory and with wrong extension
i have fallowed this tutorial htf and everything went smoothly, fail2ban starts nicely, i disabled selinux just in case, but ...
- 23
1
vote
2
answers
866
views
FreeBSD 13 PF blocking jail traffic
After upgrading my FreeBSD system from 12.2 to 13.0-p3 PF is blocking all traffic to my jails.
When disabling PF everything works fine (except from being unprotected ;))
I tried to figure out what ...
- 21
0
votes
1
answer
151
views
monitoring real time file access in chroot system
I was wondering if it's possible to write a shell script that:
runs chroot for a given userspec and group
monitors/intercepts system calls all processes started, and what libraries they attempt to ...
- 1
0
votes
1
answer
252
views
Is there another way to restrict SSH user other than chroot jail?
I need to create a safe environment for a foreign SSH user that has to have very restricted access to our server. That is:
can only execute commands that are allowed
can only use specific software ...
- 11
4
votes
2
answers
18k
views
Pubkey SSH fails with "we did not send a packet, disable method" in freebsd jail
I have a FreeBSD VPS with 2 jails, each setup with ezjail (I know now that this is largely deprecated, but didn't at the time).
$ jls
JID IP Address Hostname Path
1 ...
3
votes
1
answer
768
views
FreeBSD jail routing issue
I have the following setup with FreeBSD jails and VNET which is supposed to grow into a DNS core net lab setup. The jailhost and the jails are running FreeBSD 12.1. The jails are connected by epair ...
- 51
2
votes
1
answer
11k
views
How to move iocage jails from one ZFS pool to another?
What is the process to move iocage and all its jails from one ZFS pool to another?
I've tried the process from this post: https://www.ixsystems.com/community/threads/how-to-move-jails-between-pools....
- 625
0
votes
0
answers
342
views
Static files getting requested with internal IP address prefix instead of domain-name prefix
I have a smoothly running FreeBSD box with a couple of jails running their own servers.
Nginx runs in its own jail and the main machine uses pf to redirect all http/s requests to Nginx. Nginx ...
- 385
1
vote
1
answer
267
views
Cannot stop Postgresql in FreeBsd Jail
I installed postgresql in a jail, it starts automatically after adding postgresql_enable="YES" to /etc/rc.conf), but now I can't stop it.
I tried /usr/local/etc/rc.d/postgresql stop, but I've got:
...
- 327
1
vote
1
answer
401
views
What is a recommended way of thransferring am iocage jail from one host to another
Source iocage thick jail running on FreeBSD-12.0p12
Destination FreeBSD-12.1p1
Both hosts are using zfs.
What is the recommended method to transfer an existing iocage thick jail from the source to ...
- 367
1
vote
1
answer
2k
views
Within FreeBSD jail – setting global environment vars
I need to set a systemwide environment variable (i.e. NODE_ENV=production) in a FreeBSD jail.
I did try setting it in /etc/profile, but when I sourced it
root@www:/ # source /etc/profile
I got
...
- 177
0
votes
2
answers
444
views
FreeBSD-12 IOCage modifying a jail's /root directory
What is the reason that copying .bash_profile from the host system into the /root directory of an iocage thin jail does not create a file that is visible to the root user when logged on to that jail?
...
- 367
5
votes
0
answers
2k
views
How to mount a fuse-sshfs file system inside a FreeBSD-12.0p10 jail
I wish to mount a remote data source locally as a fuse file system. This is listed as supported by lsvfs:
lsvfs
Filesystem Num Refs Flags
-------------------------------...
- 367
0
votes
1
answer
1k
views
how to update and maintain multiple jails (ZFS & nullfs skeleton)
There are multiple ways and tools to create jails, and now that disk spaces is becoming cheaper the creation of a full jail (having already compiled a world) is just a matter of seconds:
zfs create ...
- 568
22
votes
1
answer
13k
views
FreeBSD Jails or Docker instances [closed]
What are the main differences between jails on FreeBSD and Docker on Linux? Is one considerably more secure or more performant than the other? Jails are way older than Docker instances so the code ...
- 335
5
votes
0
answers
2k
views
FreeBSD networking setup for multiple jails - interface clones or aliases
While setting up multiple jails on a FreeBSD machine, I also (naturally) need to set up the networking for each jail. It seems to me there are two ways of achieving the same goal
setting up multiple ...
- 385
11
votes
2
answers
2k
views
How can I determine what permissions my user is missing for receiving a ZFS dataset?
I have a FreeNAS (11.1-U1) and a FreeBSD (11.1-RELEASE-p6) machine. On the FreeNAS I'd like to zfs receive recursive snapshots as a non-root user with delegated privileges. This appears to work well ...
- 161
0
votes
1
answer
265
views
Does using jails in FreeBSD count as having a switch?
My network administrators don't like when I plug switch into the building network to fan-out to multiple computers. They want single link drop per physical NIC. Previously the blocked those MACs on ...
0
votes
1
answer
5k
views
fail2ban not starting jails
I'm going nuts on my live server where fail2ban is not starting jails anymore.
When i start fail2ban, everything looks fine:
fail2ban-client -x start:
2017-11-14 15:51:32,403 fail2ban.server : INFO ...
4
votes
2
answers
2k
views
A simple, step-by-step way of setting up of "jailed" SFTP-only accounts
I feel like I've gone through every SFTP/Chroot tutorial on the Internet, and not found what I am looking for (or, at least, none of them have produced the right results). Here's my specifics:
I will ...
- 263
1
vote
0
answers
68
views
BSD jail availability in the event of NFS server failure
I have some BSD systems where I am considering the use of jails for processes that should be isolated from the rest of the system.
The host system has some NFS mounts, and there is the issue that in ...
- 255
0
votes
1
answer
477
views
apache userdir jail permissions
On Debian 8 I'm running apache2 in a jailed environment using jailkit and the userdir mod. In current jail setup users can navigate into another users directory i.e
/home/jail/home/anotheruser
and ...
- 121
2
votes
1
answer
895
views
Apache virtual hosts in jail enviroment
I have a linux server with a chroot user jail environment. Users files are kept under
/jail/username/httpdocs
and are currently resolvable under
http://IPADDRESS/~username
I need users to be ...
- 121
2
votes
1
answer
517
views
Is ssh chroot enough to allow shell access?
I'm planning to offer a backup service with limited ssh access.
The best solution i've thought of so far would be to use chroot and allow access only to certain commands like: cd,mkdir,mv,rm,rsync,...
- 57
0
votes
1
answer
208
views
jails in zfs space in freebsd 11, gives mount descfs error
Good Night, I am trying to deply a multijail environment using freebsd 11 on a OVH dedicated server.
I created the cloned interfaces and created the jail , but as soon as I try to start it tells me ...
- 7
6
votes
2
answers
941
views
Migrate FreeBSD Jails to Linux
we are running some jails in FreeBSD 10 and the decision has been made to decommission the FreeBSD server and migrate all the jails to Linux environment Red Hat 6 or 7.
Is there a straight forward ...
- 2,169
2
votes
1
answer
2k
views
FreeBSD jail as gateway
I am trying to set up a jail that will serve as a default gateway for some of my external clients.
I have a VIMAGE jail that has a dedicated IP address in my local network which I want to use as a ...
- 121
0
votes
1
answer
304
views
How to reuse filesystem subtree amongst multiple jails?
I have a FreeBSD 11 host, and I want to setup multiple jails in it.
Official guide suggests hard copying /usr/bin into each of the containers. Having that my jails shall be nearly identical, this ...
- 3
0
votes
1
answer
583
views
FreeNAS jail: Updating OpenSSL for certbot
I am using FreeNAS 9.3. Having created a jail for the purpose, I am trying to get nginx working together with certbot.
The basic problem is the following:
From what I gather this is because the base ...
- 101
0
votes
1
answer
3k
views
How do I list the user that started a service in freebsd
Just a simple question, but I've looked everywhere and can't seem to find this. I just need to know what user started a particular service. In this case, I want to know what user runs the headphones ...
- 179
0
votes
1
answer
162
views
How to disable systemcalls in ftp environment with vsftpd?
I've set up a vsftpd server with local users jailed within their home directories.
Anyhow if I connect through a ftp client I can execute systemcalls with the "!" command.
How can I configure vsftpd ...
- 174
2
votes
1
answer
1k
views
Recommended way to run CentOS 7 on a host FreeBSD: VM or jailed environment?
I need to deploy either a CentOS VM or a jailed instance on a FreeBSD server (10.3).
The solutions devised:
- run it through VirtualBox (headless)
- use bhyve
I thought about a third alternative: ...
- 23
0
votes
0
answers
659
views
Jailkit: cannot su to jailed user
As a part of a bigger setup (docker container with safe environment for running python scripts), I need to configure a jailed user. I have looked at different options and decided to try Jailkit. ...
- 1,221
0
votes
1
answer
4k
views
DNS lookup to localhost gives network error
I am running a recursive DNS server on Unbound in a jail on FreeBSD with pf as a firewall.
Running drill @xxx.xxx.xxx.xxx example.com (where xxx.xxx.xxx.xxx is the servers IP) on my local machine ...
3
votes
0
answers
915
views
How to diagnose netstat: no namelist
I had to replace an NIC on my HP Proliant Microserver, running FreeNAS 9.3
In my crashplan jail, I now get "netstat: no namelist" as a response when I execute the netstat command. How to I diagnose ...
- 135
2
votes
2
answers
457
views
gethostbyname failure and network timeouts in jail
I have a FreeBSD DigitalOcean droplet in which I followed this guide exactly for setting up a jail. The problem is I cannot get reliable network connectivity inside the jail. Doing curl https://www....
- 151
0
votes
1
answer
2k
views
smtp sending mail as "Charlie &"
I'm trying to use ssmtp to send mail from my jails to the mail hub in one of them.
However, the from name isn't properly being renamed. The & isn't being replaced with root so I'm getting mails ...
- 313
3
votes
1
answer
401
views
Should Postfix run chrooted if it already is in it a FreeBSD jail?
I'm running Postfix together with Dovecot and a few milters in a FreeBSD jail.
Is there a significant security gain when I run SMTP and SMTPD daemons chrooted as well?
- 313
2
votes
2
answers
2k
views
FreeBSD & Jails: Send mail through Postfix in Jail
I have FreeBSD 10.2 and I'm using several Jails, one of them has Postfix installed.
I want my other jails and my host system to use the local Postfix installation in the Jail. They should use ...
- 313
1
vote
1
answer
654
views
ezjail: "partially completed upgrade"
I just updated FreeBSD to 10.2 and after trying to update my jails through ezjail I get the following :
ezjail-admin update -u
Looking up update.FreeBSD.org mirrors... 5 mirrors found.
Fetching ...
- 313
1
vote
1
answer
3k
views
What are the correct Linux permissions inside chroot jail with userspec
I am trying to setup a chroot jail, then I did:
which binary
ldd /bin/binary
Then I did:
cp /lib64/{libs} $jail/lib64
cp /usr/lib64/{libs} $jail/usr/lib64
PS: During this setup, I discovered that /...
- 131
1
vote
2
answers
1k
views
Shutting down host from within jail
I've created a jail with ssh using Finch-Freebsd on a NAS4FREE and added a local non super user to access the jail via ssh.
I want to be able to grant this user limited shell access specifically to ...
- 237
0
votes
1
answer
192
views
apache / mysql unable to connect jails with PF firewall
I have setup two jail environments on FreeBSD11
root@ns312773:/etc # jls
JID IP Address Hostname Path
1 10.6.6.6 www /usr/jails/...
- 213