31
votes
Accepted
FreeBSD Jails or Docker instances
I will address some of the aspects of FreeBSD jails and Linux Docker, of how they are similar and how they are different.
both serve the same goal: it's an implementation of lightweight ...
- 8,608
8
votes
Accepted
How to move iocage jails from one ZFS pool to another?
To move iocage from /mnt/OLD/iocage to /mnt/NEW/iocage:
Export jails
iocage stop JAILNAME
iocage export JAILNAME
This creates a dated .zip of the jail in /mnt/OLD/iocage/images.
Set up new pool
Use ...
- 595
5
votes
How can I determine what permissions my user is missing for receiving a ZFS dataset?
When troubleshooting permission problems arising from zfs commands, analyze the zfs operation in terms of its component steps.
The sample command of zfs receive -duvF unpacks into several steps. Two ...
- 655
5
votes
Accepted
Shutting down host from within jail
As Kassandry said, you can't do this with a command within the jail itself.
What you could do, however, would be to create a separate user (who I will henceforth call closer on the host system. This ...
- 27.7k
5
votes
Migrate FreeBSD Jails to Linux
Depending of your current running services, it can be straightforward. Lot of tools are available between these two platforms.
backup your server, jails and every data. If you are using zfs, you can ...
- 151
4
votes
Migrate FreeBSD Jails to Linux
You are going to have to port the applications one by one im afraid as has previously been mentioned the linux containers and bsd jails are two completely different things. This shouldn't be to hard ...
- 158
4
votes
Accepted
Should Postfix run chrooted if it already is in it a FreeBSD jail?
Jail is already a chrooted environment so you can't gain more benefits chrooting jailed software.
- 6,954
3
votes
Pubkey SSH fails with "we did not send a packet, disable method" in freebsd jail
I suggest checking OpenSSH version. I recently got such error after upgrading my client's OpenSSH version to 8.8.
https://www.openssh.com/releasenotes.html
Incompatibility is more likely when ...
- 47
3
votes
Accepted
A simple, step-by-step way of setting up of "jailed" SFTP-only accounts
OK, I finally got it working. There were a few things I was doing wrong, and obviously my attempts to do it over and over again screwed up some settings so I just hosed the instance and started from ...
- 233
3
votes
Accepted
How to disable systemcalls in ftp environment with vsftpd?
Commands that start with an exclamation mark ! escape the FTP client and are executed locally with the rights of your local user. The don't run on the server, actually they won't even reach the ...
- 75.2k
3
votes
Shutting down host from within jail
Jails specifically forbid the shutdown commands, per the manual page here.
Normal machine shutdown commands, such as halt(8), reboot(8), and shutdown(8), cannot be used successfully within the ...
- 679
2
votes
OpenSSH anything like 'internal-sftp' but for SCP?
Due to a weird coincidence, you don't need to change anything if the scp clients use OpenSSH ≥8.8. Means, you can then keep your current setup using ForceCommand internal-sftp to provide a SFTP server....
- 666
2
votes
Fail2ban MTA=Postfix Setting in Jail Config giving Error
Ok, digging up an old thread but this is how I got postfix to work with Fail2ban:
in /etc/fail2ban/action.d/
I copied and renamed this files by changing all the sendmail to postfix
Works fine for me ...
2
votes
Accepted
What is the best method of installing programs into a chroot / jail?
There are multiple ways to setup chroot jails. Personally I've seen over 50 different scripts for that. All jails are similar, but have smaller or bigger differences, so there is no generic way to do ...
- 458
2
votes
Accepted
How to reuse filesystem subtree amongst multiple jails?
In FreeBSD your can use nullfs to mount subtree of filesystem.
There are several tools to make jail creating/updating more easy (listed in the Freebsd Wiki). One of them ezjail and ezjail uses nullfs ...
- 469
2
votes
Accepted
How do I list the user that started a service in freebsd
'ps aux' will do the tip to list all users process
- 16.7k
2
votes
Accepted
DNS lookup to localhost gives network error
After some more testing the pf rules, I briefly let all traffic pass and realized the mistake was that while I had pass quick on lo0 all in the pf.conf, the jail is running under lo1.
I added pass ...
2
votes
smtp sending mail as "Charlie &"
Charlie & is the Full Name of the root user.
Use the command:
chpass
to change the root user information, in your case, the full name.
- 121
2
votes
Does using jails in FreeBSD count as having a switch?
There are many ways to run jails, virtual interfaces are one thing but with jails you can borrow just a particular IP address to the underlying system. Of course layer2 either should be allowed or ...
- 61
2
votes
Within FreeBSD jail – setting global environment vars
Q: "Set a systemwide environment variable in a FreeBSD jail."
A: Set the variable both in /etc/profile and /etc/csh.cshrc.
Details
Quoting from 3.9. Shells
How to set an environment variable ...
- 4,723
2
votes
Accepted
FreeBSD jail routing issue
Long story short, it wasn't related to jails or epair at all. I just forgot to set an entry for the return route.
- 51
1
vote
Pubkey SSH fails with "we did not send a packet, disable method" in freebsd jail
It could be the permissions of the home directory of the user you're trying to log into which is not accepted by the ssh server, could you post those please?
If you want to keep the permissions as ...
- 146
1
vote
Accepted
What is a recommended way of thransferring am iocage jail from one host to another
iocage comes with a great export/import function.
$ man iocage
...
export Exports the specified jail. An archive file is created in
/iocage/images with an SHA256 checksum. ...
- 126
1
vote
Accepted
how to update and maintain multiple jails (ZFS & nullfs skeleton)
ezjail covers the use-case you described. To answer your question:
How you deal with rolling upgrades?
Let me quote from FreeBSD Handbook 14.6.2. Initial Setup:
To Populate the Jail with ...
- 4,723
1
vote
Apache virtual hosts in jail enviroment
It's possible, but not a great idea. The only real way to do this is include those files in the main apache config; but in doing so they can put directives that are not vhost specific in those files. ...
- 5,143
1
vote
Is ssh chroot enough to allow shell access?
I would suggest you take a look at unprivileged containers: https://linuxcontainers.org/lxc/getting-started/
Containers provide better isolation compared to a chroot jail.
It still has low overhead. ...
- 1,540
1
vote
FreeBSD jail as gateway
FreeBSD jails are basically a sort of lightweight virtualization, so it's best purpose - is to run some applications as containers. It surely has a network stack, but, comparing its functionality with ...
- 8,608
1
vote
Accepted
mongod bind_ip bind to wrong ip
You probably need to add 127.0.0.1 to the jail, as jails will forbid binding to anything but the jail ip.
But, if you want to confine mongo just to the jail, maybe a better idea would be to firewall ...
- 3,947
1
vote
Sending syslog from jail to host fails
As @citrin mentions, the -ss flag is not what you want.
The following works for me, on FreeBSD 12.1, with no vnet virtualization configured.
192.168.1.1 is the IP of the host.
192.168.1.68 is the IP ...
- 655
1
vote
SSH_ORIGINAL_COMMAND variable not getting set
Look in /etc/profile and other init scripts (~/.bashrc etc) - those are some things which set environment variables.
Remember that you need a ". " in place of scripts if you want their ...
- 169
Only top scored, non community-wiki answers of a minimum length are eligible