Managing jails with ezjail - Revision history

Tykling: Redirected page to Ezjail host

2012-07-30T15:46:47Z

Redirected page to Ezjail host

← Older revision		Revision as of 15:46, 30 July 2012
Line 1:		Line 1:
	#REDIRECT [[~~Ezjail~~]]		#REDIRECT [[Ezjail_host]]

Tykling: Redirected page to Ezjail

2012-07-30T15:46:30Z

Redirected page to Ezjail

Show changes

Tykling: /* Services listening on * */

2009-08-10T10:31:30Z

Services listening on *

← Older revision		Revision as of 10:31, 10 August 2009
Line 159:		Line 159:

	I still like to bind the services explicitly though, so I edit ''/etc/ssh/sshd_config'' to make it listen on 127.0.2.25 specifically. I do the same with syslogd, by adding ''syslogd_flags="-s -b 127.0.2.25"'' to /etc/rc.conf.		I still like to bind the services explicitly though, so I edit ''/etc/ssh/sshd_config'' to make it listen on 127.0.2.25 specifically. I do the same with syslogd, by adding ''syslogd_flags="-s -b 127.0.2.25"'' to /etc/rc.conf.

			The advantage of binding services explicitly to the jails IP address is that any services bound to * in a jail will show up in a ''sockstat -l'' on the host system as though they are listening on all IP addresses on the system, even though it is actually limited to only the jail IP. So there is a lot less confusion when jail services are just bound explicitly to the jails IP.

	The jails rc.conf now looks like this:		The jails rc.conf now looks like this:

Tykling at 16:36, 9 August 2009

2009-08-09T16:36:54Z

← Older revision		Revision as of 16:36, 9 August 2009
Line 277:		Line 277:
	=== Further configuration ===		=== Further configuration ===
	After this is completed the jails are ready to be configured to whatever they are meant to do - in this case, I will install postfix and configure them to act as incoming mail servers for a few domains. I will configure seperate jails for other parts of the mailserver, a jail for dovecot (actually two), a jail for spamassassin (actually two) and so on.		After this is completed the jails are ready to be configured to whatever they are meant to do - in this case, I will install postfix and configure them to act as incoming mail servers for a few domains. I will configure seperate jails for other parts of the mailserver, a jail for dovecot (actually two), a jail for spamassassin (actually two) and so on.

			== Updating the jail ==
			ezjail has a method for updating the jail from a world built with the standard "make buildworld" process. I started using freebsd-update to update my servers a while back, and because of that I need to use a different method for updating my jails. It basically comes down to running freebsd-update on the host system, piping the output to a file, and then copy the list of updated files to the basejail and restart the jails. Unfortunately I am running the latest release of FreeBSD 8 on this server at the moment, so I'll have to wait until an update comes out to finish this section :)

Tykling at 16:21, 9 August 2009

2009-08-09T16:21:58Z

← Older revision		Revision as of 16:21, 9 August 2009
Line 1:		Line 1:
	This is a list to help me remember the details of managing FreeBSD jails with ezjail. This example was all done on FreeBSD 8.0-BETA2 with ezjail-3.0.		This is a list to help me remember the details of managing FreeBSD jails with ezjail. This example was all done on FreeBSD 8.0-BETA2 with ezjail-3.0. Sections 2-4 have to do with the host system configuration, sections five and six need to be repeated for each new jail created.

	== Getting started ==		== Getting started ==
Line 69:		Line 69:
	</pre>		</pre>

	== ~~Setting up~~ a new jail ==		== Creating a new jail ==
	This section is a step by step guide to creating a new jail.		This section is a step by step guide to creating a new jail. The steps below should be followed for each new jail to be configured.

	=== Configure an IP address for the jail ===		=== Configure an IP address for the jail ===
Line 76:		Line 76:
	I also use a seperate ''lo'' interface, and leave the normal lo0 interface alone. This can be accomplished in rc.conf like so:		I also use a seperate ''lo'' interface, and leave the normal lo0 interface alone. This can be accomplished in rc.conf like so:
	<pre>		<pre>
			#create lo1 for use by jails
	cloned_interfaces="lo1"		cloned_interfaces="lo1"
	ifconfig_lo1="inet 127.0.0.2/8"		ifconfig_lo1="inet 127.0.0.2/8"

			#jail IP addresses for the two postfix jails
	ifconfig_lo1_alias0="127.0.1.25/32"		ifconfig_lo1_alias0="127.0.1.25/32"
	ifconfig_lo1_alias1="127.0.2.25/32"		ifconfig_lo1_alias1="127.0.2.25/32"
Line 124:		Line 127:
	As you can see, I created another jail by repeating the steps above before I started ezjail. The output of the ''jls'' command shows that the two new jails are running as expected.		As you can see, I created another jail by repeating the steps above before I started ezjail. The output of the ''jls'' command shows that the two new jails are running as expected.

	== "Getting into" a new jail ==
			== Initial configuration of a new jail ==
			There is a few things that I need to remember whenever configuring a new jail in this fashion.

			=== "Getting into" the new jail ===
	To get a shell in the new jail, run the ''jexec'' command with the jail id and the ''sh'' command like so:		To get a shell in the new jail, run the ''jexec'' command with the jail id and the ''sh'' command like so:
	<pre>		<pre>
Line 136:		Line 143:
	#		#
	</pre>		</pre>

	~~== Initial configuration of a new jail ==~~
	~~There is a few things that I need to remember whenever configuring a new jail in this fashion.~~

	=== Create rc.conf ===		=== Create rc.conf ===

Tykling: /* net-snmp */

2009-08-09T16:12:40Z

net-snmp

← Older revision		Revision as of 16:12, 9 August 2009
Line 60:		Line 60:
	I restart all three daemons, and now everything is listening on the host systems main or loopback address, nothing is bound to *:port in the column "LOCAL ADDRESS", which is what I wanted:		I restart all three daemons, and now everything is listening on the host systems main or loopback address, nothing is bound to *:port in the column "LOCAL ADDRESS", which is what I wanted:
	<pre>		<pre>
	~~[tykling@peace ~]$ sockstat -l4~~
	[tykling@peace ~]$ sockstat -l4		[tykling@peace ~]$ sockstat -l4
	USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS		USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS

Tykling at 16:12, 9 August 2009

2009-08-09T16:12:12Z

← Older revision		Revision as of 16:12, 9 August 2009
Line 1:		Line 1:
	This is a list to help me remember the details of managing FreeBSD jails with ezjail.		This is a list to help me remember the details of managing FreeBSD jails with ezjail. This example was all done on FreeBSD 8.0-BETA2 with ezjail-3.0.

	== Getting started ==		== Getting started ==

Tykling: /* Install basic ports */

2009-08-09T15:11:05Z

Install basic ports

← Older revision		Revision as of 15:11, 9 August 2009
Line 237:		Line 237:
	* security/sudo - to avoid working as root.		* security/sudo - to avoid working as root.

	Before I can install any ports I need the ports tree. The first time I run portsnap I need to use the following command:		Before I can install any ports I need the ports tree. ezjail defaults to mounting a read-only copy of the ports tree from the basejail in ''/usr/jails/basejail'', but I like each jail to have it's own ports tree. So the first thing I do is to remove the symlink created by ezjaill, before I run ''portsnap'':
			<pre>
			# rm /usr/ports
			</pre>
			The first time I run portsnap I need to use the following command:
	<pre>		<pre>
	# portsnap fetch extract		# portsnap fetch extract

Tykling: /* Install basic ports */

2009-08-09T14:07:48Z

Install basic ports

← Older revision		Revision as of 14:07, 9 August 2009
Line 233:		Line 233:
	I always install a few ports in a new jail:		I always install a few ports in a new jail:
	* ports-mgmt/portmaster - my favourite port management tool.		* ports-mgmt/portmaster - my favourite port management tool.
	* security/openssh-portable - I like running deamons from ports, ports are easier to upgrade than things in the base system. After installing this I change ''sshd_enable="YES"'' to ''openssh_enable="YES"'' in /etc/rc.conf, and then stop the old sshd and start the new one. ~~You can even do this over ssh :)~~		* security/openssh-portable - I like running deamons from ports, ports are easier to upgrade than things in the base system. After installing this I change ''sshd_enable="YES"'' to ''openssh_enable="YES"'' in /etc/rc.conf, and then stop the old sshd and start the new one.
	* shells/bash - can't live without it.		* shells/bash - can't live without it.
	* security/sudo - to avoid working as root.		* security/sudo - to avoid working as root.

Tykling: /* Install basic ports */

2009-08-09T14:07:15Z

Install basic ports

← Older revision		Revision as of 14:07, 9 August 2009
Line 232:		Line 232:
	=== Install basic ports ===		=== Install basic ports ===
	I always install a few ports in a new jail:		I always install a few ports in a new jail:
	* security/openssh-portable - I like running deamons from ports, ports are easier to upgrade than things in the base system.		* ports-mgmt/portmaster - my favourite port management tool.
			* security/openssh-portable - I like running deamons from ports, ports are easier to upgrade than things in the base system. After installing this I change ''sshd_enable="YES"'' to ''openssh_enable="YES"'' in /etc/rc.conf, and then stop the old sshd and start the new one. You can even do this over ssh :)
	* shells/bash - can't live without it.		* shells/bash - can't live without it.
	* security/sudo - to avoid working as root.		* security/sudo - to avoid working as root.
	* ports-mgmt/portmaster - my favourite port management tool.

	Before I can ~~do that though,~~ I need the ports tree. The first time I run portsnap I need to use the following command:		Before I can install any ports I need the ports tree. The first time I run portsnap I need to use the following command:
	<pre>		<pre>
	# portsnap fetch extract		# portsnap fetch extract
Line 248:		Line 248:
	..... snip ........		..... snip ........
	</pre>		</pre>

			Any future runs of portsnap will be with the command ''portsnap fetch update'' instead of ''portsnap fetch extract''.

	Then I install ''portmaster'', and use that to install the rest of the ports.		Then I install ''portmaster'', and use that to install the rest of the ports.