How to install a FreeBSD Jail (also known as a FreeBSD VPS). This page was first written using a 6.4 version of freebsd. A Jail on freebsd is the perfect solution for separating services; that is, if one Jail is compromised by an attacker, the rest of the machine will be just fine.
I very much suggest reading: #man jail .The examples section is full of useful information!
I want to create my jail in the directory “/path/myjail” All the files in the jail system will be created inside this directory on my freebsd host system. Making world can take considerable time, so to shorten that time, you can edit your /etc/make.conf and ADD some lines like:
NO_ACPI= true # do not build acpiconf(8) and related programs NO_BLUETOOTH= true # do not build Bluetooth related stuff NO_FORTRAN= true # do not build g77 and related libraries
However, there is NO guarantee that what you leave out will Not be neaded some time in the future. Here, we are assuming you HAVE a /usr/src on your system. If not, go find the tutorial that tells you how to obtain it.
#mkdir /path/myjail #cd /usr/src/ #make world DESTDIR=/path/myjail #make distribution DESTDIR=/path/myjail
In order to start the Jail on boot, in your Host system /etc/rc.conf you must have something like:
syslogd_flags="-ss" ifconfig_em0="inet 192.168.1.5 netmask 255.255.255.0" # the HOSTS ip address defaultrouter="192.168.1.1" ifconfig_em0_alias0="inet 192.168.1.10 netmask 255.255.255.0" #an ALIAS for the jail jail_enable="YES" jail_interface="em0" jail_devfs_enable="YES" jail_procfs_enable="YES" jail_list="myjail" #this can be: "myjail myotherjail thirdjail" jail_myjail_rootdir="/path/myjail" #NOTE how the setting is jail_MY-JAIL_.. jail_myjail_hostname="myjail.example.com" #this jail's hostname jail_myjail_ip="192.168.1.10" #same as the alias above jail_myjail_exec_start="/bin/sh /etc/rc" jail_myjail_devfs_enable="YES" jail_myjail_devfs_ruleset="devfsrules_jail" #im not sure what this is for jail_socket_unixiproute_only="YES"
In the JAIL’s /etc/rc.conf : (which would be /path/to/myjail/etc/rc.conf)
#ee /etc/rc.conf hostname="myjail.example.com" ifconfig_em0="inet 192.168.1.10 netmask 255.255.255.0" defaultrouter="192.168.1.1" rpcbind_enable="NO" sshd_enable="YES" syslogd_flags="-ss" sendmail_enable="NONE"
In order for JAILS to work, on the Host system there MUST Not be any daemon listening on * (all interfaces). To see if there is any use
#netstat -an or #sockstat
Personally I had syslogd, sshd and mysqld listening on :*. For syslogd the fix is to set the “-ss” in /etc/rc.conf (on the host). For sshd you must edit /etc/ssh/sshd_config
ListenAddress 192.168.1.5
- /etc/rc.d/sshd restart
For mysql you must edit my.cnf and add
bind-address=192.168.1.5
I could NOT add more than ONE address which made my a little
furious with mysql. You could also have sendmail listnening, I didnt.
To list running jails you can use : (here it is showing one jail running)
# jls
JID IP Address Hostname Path
1 192.168.1.10 myjail-hostname /path/to/myjail
#jls -v
JID Hostname Path
Name State
CPUSetID
IP Address(es)
2 subdomain.domain.com /date/path
ALIVE
3
192.x.x.39
192.x.x.33
192.x.x.34
192.x.x.35
In order for jails to work, they need some special filesystems mounted:
#mount -t devfs devfs /path/myjail/dev #mount -t procfs procfs /path/myjail/proc #df -h Filesystem Size Used Avail Capacity Mounted on /dev/da0s1a 7.6G 6.5G 465M 93% / devfs 1.0K 1.0K 0B 100% /dev devfs 1.0K 1.0K 0B 100% /path/myjail/dev procfs 4.0K 4.0K 0B 100% /path/myjail/proc
To start or stop a jail : (myjail is the name from the list in rc.conf)
- /etc/rc.d/jail start myjail
or
- /etc/rc.d/jail stop myjail
NOTE: if you want to SSH into your jail, you might want to PERMITROOTlogin yes, but watch out for security.
In the Jail you need to:
- touch /etc/fstab
and copy /etc/resolv.conf
You can execute commands in the JAIL from the HOST system using jexec:
- jexec 1 passwd
1 is the JID of the jail(from jls), and passwd is the command to Change the root password in the JAIL !
You can start a jail manually with:
- jail /path/myjail myjail.example.com 192.168.1.10 /bin/sh
Once INSIDE the jail do:
- /bin/sh /etc/rc
To install stuff you need: (in the HOST)
mount_nullfs /usr/ports /path/myjail/usr/ports mount_nullfs /usr/src /path/myjail/usr/src
If you need to use ping inside jail, you must set sysctl security.jail.allow_raw_sockets=1 (add security.jail.allow_raw_sockets=1 in hosts sysctl.conf).
sysctl -a | grep jail
To delete a jail you need to check if the immutable bit is
set on files in the jail (which appears to be the case in the jail
/lib)
/path/myjail/lib#ls -lo
-r--r--r-- 1 root wheel schg 1184384 Sep 6 18:05 libc.so.7
-r--r--r-- 1 root wheel - 102024 Sep 6 18:06 libcam.so.4
-r--r--r-- 1 root wheel schg 33008 Sep 6 18:06 libcrypt.so.4
libc.so.7 ans libcrypt have the immbutable bit set
to delete these files you must remove the bit first
/path/myjail#chflags -R noschg *
The combination "no"+flags_name turns off the flag. There are more flags:
The flags are specified as an octal number or a comma separated list of
keywords. The following keywords are currently defined:
arch set the archived flag (super-user only)
opaque set the opaque flag (owner or super-user only)
nodump set the nodump flag (owner or super-user only)
sappnd set the system append-only flag (super-user only)
schg set the system immutable flag (super-user only)
sunlnk set the system undeletable flag (super-user only)
uappnd set the user append-only flag (owner or super-user only)
uchg set the user immutable flag (owner or super-user only)
uunlnk set the user undeletable flag (owner or super-user only)
Cool links related: http://en.jnlin.org/2008/06/07/12/
http://www.freebsd.org/doc/en/books/handbook/jails-build.html
http://www.openaddict.com/node/36
http://www.section6.net/wiki/index.php/Creating_a_FreeBSD_Jail
http://blog.innerewut.de/2005/08/25/freebsd-jails