Questions tagged [jail]
Jails improve on the concept of the traditional chroot environment in several ways. In a traditional chroot environment, processes are only limited in the part of the file system they can access.
114
questions
2
votes
1
answer
373
views
Use netns to bind programs to specific IP addresses
I have an IP address on my server, say, 192.168.0.3, I want to share in a net namespace, so to run apps there which will only be able to communicate to the internet using that 192.168.0.3.
I can "...
- 21
1
vote
0
answers
1k
views
FreeNAS unable to resolve hostnames, ping of any external IP returns host's ip instead
The internal IP address of my router changed, and ever since TrueNAS has been misbehaving. None of the jails can resolve a hostname anymore. In troubleshooting this, I discovered that the client ...
- 111
0
votes
0
answers
97
views
ARP Connectivity Issues Between OpenMediaVault Server and BSD Jails
On my network I have two servers.
Server1 is running TrueNas(BSD) with multiple applications running in iocage jails. It's connected to the network with a 3-nic LAGG.
Server2 is an OpenMediaVault (...
- 58
0
votes
1
answer
79
views
Services whithin jails no longer accessible after upgrade to version 13.0
After upgrading a virtual FreeBSD 12.2 system to 13.0-p3, traffic to services within jails (through Apache 2.4 reverse proxy) was blocked.
This is a Hyper-V virtual server and the second one that ...
- 21
1
vote
1
answer
457
views
fail2ban does not start jails on cenots 7
SOLVED - sshd conf file was in wrong directory and with wrong extension
i have fallowed this tutorial htf and everything went smoothly, fail2ban starts nicely, i disabled selinux just in case, but ...
- 13
1
vote
2
answers
609
views
FreeBSD 13 PF blocking jail traffic
After upgrading my FreeBSD system from 12.2 to 13.0-p3 PF is blocking all traffic to my jails.
When disabling PF everything works fine (except from being unprotected ;))
I tried to figure out what ...
- 21
0
votes
1
answer
96
views
monitoring real time file access in chroot system
I was wondering if it's possible to write a shell script that:
runs chroot for a given userspec and group
monitors/intercepts system calls all processes started, and what libraries they attempt to ...
- 1
0
votes
1
answer
207
views
Is there another way to restrict SSH user other than chroot jail?
I need to create a safe environment for a foreign SSH user that has to have very restricted access to our server. That is:
can only execute commands that are allowed
can only use specific software ...
- 11
3
votes
2
answers
14k
views
Pubkey SSH fails with "we did not send a packet, disable method" in freebsd jail
I have a FreeBSD VPS with 2 jails, each setup with ezjail (I know now that this is largely deprecated, but didn't at the time).
$ jls
JID IP Address Hostname Path
1 ...
3
votes
1
answer
677
views
FreeBSD jail routing issue
I have the following setup with FreeBSD jails and VNET which is supposed to grow into a DNS core net lab setup. The jailhost and the jails are running FreeBSD 12.1. The jails are connected by epair ...
- 51
1
vote
1
answer
10k
views
How to move iocage jails from one ZFS pool to another?
What is the process to move iocage and all its jails from one ZFS pool to another?
I've tried the process from this post: https://www.ixsystems.com/community/threads/how-to-move-jails-between-pools....
- 605
0
votes
0
answers
307
views
Static files getting requested with internal IP address prefix instead of domain-name prefix
I have a smoothly running FreeBSD box with a couple of jails running their own servers.
Nginx runs in its own jail and the main machine uses pf to redirect all http/s requests to Nginx. Nginx ...
- 365
1
vote
1
answer
220
views
Cannot stop Postgresql in FreeBsd Jail
I installed postgresql in a jail, it starts automatically after adding postgresql_enable="YES" to /etc/rc.conf), but now I can't stop it.
I tried /usr/local/etc/rc.d/postgresql stop, but I've got:
...
- 327
0
votes
1
answer
340
views
What is a recommended way of thransferring am iocage jail from one host to another
Source iocage thick jail running on FreeBSD-12.0p12
Destination FreeBSD-12.1p1
Both hosts are using zfs.
What is the recommended method to transfer an existing iocage thick jail from the source to ...
- 337
1
vote
1
answer
1k
views
Within FreeBSD jail – setting global environment vars
I need to set a systemwide environment variable (i.e. NODE_ENV=production) in a FreeBSD jail.
I did try setting it in /etc/profile, but when I sourced it
root@www:/ # source /etc/profile
I got
...
- 167
0
votes
2
answers
412
views
FreeBSD-12 IOCage modifying a jail's /root directory
What is the reason that copying .bash_profile from the host system into the /root directory of an iocage thin jail does not create a file that is visible to the root user when logged on to that jail?
...
- 337
5
votes
0
answers
2k
views
How to mount a fuse-sshfs file system inside a FreeBSD-12.0p10 jail
I wish to mount a remote data source locally as a fuse file system. This is listed as supported by lsvfs:
lsvfs
Filesystem Num Refs Flags
-------------------------------...
- 337
0
votes
1
answer
962
views
how to update and maintain multiple jails (ZFS & nullfs skeleton)
There are multiple ways and tools to create jails, and now that disk spaces is becoming cheaper the creation of a full jail (having already compiled a world) is just a matter of seconds:
zfs create ...
- 568
22
votes
1
answer
12k
views
FreeBSD Jails or Docker instances [closed]
What are the main differences between jails on FreeBSD and Docker on Linux? Is one considerably more secure or more performant than the other? Jails are way older than Docker instances so the code ...
- 335
5
votes
0
answers
2k
views
FreeBSD networking setup for multiple jails - interface clones or aliases
While setting up multiple jails on a FreeBSD machine, I also (naturally) need to set up the networking for each jail. It seems to me there are two ways of achieving the same goal
setting up multiple ...
- 365
11
votes
2
answers
2k
views
How can I determine what permissions my user is missing for receiving a ZFS dataset?
I have a FreeNAS (11.1-U1) and a FreeBSD (11.1-RELEASE-p6) machine. On the FreeNAS I'd like to zfs receive recursive snapshots as a non-root user with delegated privileges. This appears to work well ...
- 161
0
votes
1
answer
261
views
Does using jails in FreeBSD count as having a switch?
My network administrators don't like when I plug switch into the building network to fan-out to multiple computers. They want single link drop per physical NIC. Previously the blocked those MACs on ...
0
votes
1
answer
4k
views
fail2ban not starting jails
I'm going nuts on my live server where fail2ban is not starting jails anymore.
When i start fail2ban, everything looks fine:
fail2ban-client -x start:
2017-11-14 15:51:32,403 fail2ban.server : INFO ...
2
votes
2
answers
2k
views
A simple, step-by-step way of setting up of "jailed" SFTP-only accounts
I feel like I've gone through every SFTP/Chroot tutorial on the Internet, and not found what I am looking for (or, at least, none of them have produced the right results). Here's my specifics:
I will ...
- 233
1
vote
0
answers
60
views
BSD jail availability in the event of NFS server failure
I have some BSD systems where I am considering the use of jails for processes that should be isolated from the rest of the system.
The host system has some NFS mounts, and there is the issue that in ...
- 255
0
votes
1
answer
426
views
apache userdir jail permissions
On Debian 8 I'm running apache2 in a jailed environment using jailkit and the userdir mod. In current jail setup users can navigate into another users directory i.e
/home/jail/home/anotheruser
and ...
- 121
2
votes
1
answer
859
views
Apache virtual hosts in jail enviroment
I have a linux server with a chroot user jail environment. Users files are kept under
/jail/username/httpdocs
and are currently resolvable under
http://IPADDRESS/~username
I need users to be ...
- 121
2
votes
1
answer
466
views
Is ssh chroot enough to allow shell access?
I'm planning to offer a backup service with limited ssh access.
The best solution i've thought of so far would be to use chroot and allow access only to certain commands like: cd,mkdir,mv,rm,rsync,...
- 57
0
votes
1
answer
198
views
jails in zfs space in freebsd 11, gives mount descfs error
Good Night, I am trying to deply a multijail environment using freebsd 11 on a OVH dedicated server.
I created the cloned interfaces and created the jail , but as soon as I try to start it tells me ...
- 7
6
votes
2
answers
896
views
Migrate FreeBSD Jails to Linux
we are running some jails in FreeBSD 10 and the decision has been made to decommission the FreeBSD server and migrate all the jails to Linux environment Red Hat 6 or 7.
Is there a straight forward ...
- 2,119
2
votes
1
answer
1k
views
FreeBSD jail as gateway
I am trying to set up a jail that will serve as a default gateway for some of my external clients.
I have a VIMAGE jail that has a dedicated IP address in my local network which I want to use as a ...
- 121
0
votes
1
answer
288
views
How to reuse filesystem subtree amongst multiple jails?
I have a FreeBSD 11 host, and I want to setup multiple jails in it.
Official guide suggests hard copying /usr/bin into each of the containers. Having that my jails shall be nearly identical, this ...
- 3
0
votes
1
answer
576
views
FreeNAS jail: Updating OpenSSL for certbot
I am using FreeNAS 9.3. Having created a jail for the purpose, I am trying to get nginx working together with certbot.
The basic problem is the following:
From what I gather this is because the base ...
- 101
0
votes
1
answer
3k
views
How do I list the user that started a service in freebsd
Just a simple question, but I've looked everywhere and can't seem to find this. I just need to know what user started a particular service. In this case, I want to know what user runs the headphones ...
- 179
0
votes
1
answer
154
views
How to disable systemcalls in ftp environment with vsftpd?
I've set up a vsftpd server with local users jailed within their home directories.
Anyhow if I connect through a ftp client I can execute systemcalls with the "!" command.
How can I configure vsftpd ...
- 174
2
votes
1
answer
1k
views
Recommended way to run CentOS 7 on a host FreeBSD: VM or jailed environment?
I need to deploy either a CentOS VM or a jailed instance on a FreeBSD server (10.3).
The solutions devised:
- run it through VirtualBox (headless)
- use bhyve
I thought about a third alternative: ...
- 23
0
votes
0
answers
606
views
Jailkit: cannot su to jailed user
As a part of a bigger setup (docker container with safe environment for running python scripts), I need to configure a jailed user. I have looked at different options and decided to try Jailkit. ...
- 1,211
0
votes
1
answer
3k
views
DNS lookup to localhost gives network error
I am running a recursive DNS server on Unbound in a jail on FreeBSD with pf as a firewall.
Running drill @xxx.xxx.xxx.xxx example.com (where xxx.xxx.xxx.xxx is the servers IP) on my local machine ...
3
votes
0
answers
901
views
How to diagnose netstat: no namelist
I had to replace an NIC on my HP Proliant Microserver, running FreeNAS 9.3
In my crashplan jail, I now get "netstat: no namelist" as a response when I execute the netstat command. How to I diagnose ...
- 135
2
votes
2
answers
439
views
gethostbyname failure and network timeouts in jail
I have a FreeBSD DigitalOcean droplet in which I followed this guide exactly for setting up a jail. The problem is I cannot get reliable network connectivity inside the jail. Doing curl https://www....
- 151
0
votes
1
answer
2k
views
smtp sending mail as "Charlie &"
I'm trying to use ssmtp to send mail from my jails to the mail hub in one of them.
However, the from name isn't properly being renamed. The & isn't being replaced with root so I'm getting mails ...
- 313
3
votes
1
answer
390
views
Should Postfix run chrooted if it already is in it a FreeBSD jail?
I'm running Postfix together with Dovecot and a few milters in a FreeBSD jail.
Is there a significant security gain when I run SMTP and SMTPD daemons chrooted as well?
- 313
2
votes
2
answers
2k
views
FreeBSD & Jails: Send mail through Postfix in Jail
I have FreeBSD 10.2 and I'm using several Jails, one of them has Postfix installed.
I want my other jails and my host system to use the local Postfix installation in the Jail. They should use ...
- 313
1
vote
1
answer
604
views
ezjail: "partially completed upgrade"
I just updated FreeBSD to 10.2 and after trying to update my jails through ezjail I get the following :
ezjail-admin update -u
Looking up update.FreeBSD.org mirrors... 5 mirrors found.
Fetching ...
- 313
1
vote
1
answer
2k
views
What are the correct Linux permissions inside chroot jail with userspec
I am trying to setup a chroot jail, then I did:
which binary
ldd /bin/binary
Then I did:
cp /lib64/{libs} $jail/lib64
cp /usr/lib64/{libs} $jail/usr/lib64
PS: During this setup, I discovered that /...
- 131
1
vote
2
answers
1k
views
Shutting down host from within jail
I've created a jail with ssh using Finch-Freebsd on a NAS4FREE and added a local non super user to access the jail via ssh.
I want to be able to grant this user limited shell access specifically to ...
- 247
0
votes
1
answer
185
views
apache / mysql unable to connect jails with PF firewall
I have setup two jail environments on FreeBSD11
root@ns312773:/etc # jls
JID IP Address Hostname Path
1 10.6.6.6 www /usr/jails/...
- 203
0
votes
1
answer
113
views
Redirecting Public IPs to jails
My plan is to set up a server where I have several jails. Currently, I am planning on running three of them: a webserver, an owncloud server and a Teamspeak 3 server.
I got it running so far that I ...
- 1
2
votes
1
answer
4k
views
What is the best method of installing programs into a chroot / jail?
On a Debian based system...
I have created a minimal chroot/jail using a script similar to the one at https://github.com/pmenhart/make_chroot_jail/blob/master/make_chroot_jail.sh with the goal of ...
- 157
0
votes
1
answer
311
views
mongod bind_ip bind to wrong ip
I'm trying to setup a mongodb in a FreeBSD jail. I found in the documetation that I can set the bind_ip to 127.0.0.1 to allow only access from localhost. But when I check with sockstats it's bound to ...
- 123