FreeBSD Jails in 7.0 (Revised)
Finally, with the release of FreeBSD 7.0, here’s the updated version of the usual jail tutorial tailored to FreeBSD 7.0. Enjoy!
First I’m going to set the IP to 10.0.0.86, and then run a jail off the main interface.
# ifconfig em0 10.0.0.86 255.255.255.255 # ifconfig em0 inet alias 10.0.0.88 netmask 255.255.255.255 # ifconfig em0 em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 options=8<VLAN_MTU> inet6 fe80::204:5aff:fe6f:1d0c%dc0 prefixlen 64 scopeid 0x1 inet 10.0.0.86 netmask 0xffffff00 broadcast 192.168.115.255 inet 10.0.0.88 netmask 0xffffffff broadcast 192.168.115.181 ether 00:04:5a:6f:1d:0c media: Ethernet autoselect (100baseTX <full-duplex>) status: active
Ok. So now we have our main interface at 10.0.0.86 and our aliased IP at 10.0.0.88. Since we don’t want any inetd services listening on the aliased IP, we need to add a line to the /etc/rc.conf file.
inetd_flags=”-wW -a 10.0.0.86″
Now to make the jail. First make the directory you want the jail in.
# mkdir /usr/jail/server1
Then we make the virtual system.
# cd /usr/src
# make world DESTDIR=/usr/jail/server1
# cd etc
# make distribution DESTDIR=/usr/jail/server1
If we wanted to make a second jail, we could easily do so, without making world again:
# make distribution DESTDIR=/usr/jail/server2
As we continue on…. :
# cd /usr/jail/server1
# ln -sf /dev/null kernel
Once this is all done your jail is built and ready to be set. First, a few minor details to the setup.
# touch /usr/jail/server1/etc/fstab
# cat /etc/resolv.conf > /usr/jail/server1/etc/resolv.conf
So now we are ready to configure the jail for the first time. We start the jail with the jail command, like so:
# jail /usr/jail/server1 jail1.prison.com 10.0.0.88 /bin/sh
You will then be dropped to a new shell inside the jail. First, set your root password with ‘passwd’ or with ‘sysinstall’. Also setup a user account to use when using SSH to enter. Make sure to also run ‘newaliases’ while in this environment, otherwise you will have issues with your jail starting with sendmail. Next, create and add the SSH enable line into your new /etc/rc.conf (in the jail).
Once you have this done, type ‘exit’ to leave the jail. Now, we need to mount the proc and dev filesystems for our jail.
# mount -t procfs proc /usr/jail/server1/proc
# mount -t devfs dev /usr/jail/server1/dev
NOTE: If you are having trouble with SSH finding a console, make sure this is mounted
and now to start it all up:
# jail /usr/jail/server1 jail1.prison.com 10.0.0.88 /bin/sh /etc/rc
Now you should be able to ssh to your new jail, and start configuring the services you wish to run inside.
To double check that your jail is running, run ‘jls’
JID IP Address Hostname Path 1 10.0.0.88 jail1.prision.com /usr/jail/server1
Well, now we have a fully functioning jail. Now we need to set it up so we don’t have to start it manually. We are going to add a few more values to the rc.conf. You can probably put this anywhere in the rc.conf, but in good practice, you should put it behind main host specific entries (i.e. hostname, ifconfig, defaultroute, etc).
ifconfig_em0_alias0=”inet 10.0.0.88 netmask 0xffffffff”
Here we set the jail config name inside rc.conf, and the settings for that jail “jail_jail1*”. We also set the global setting, “jail_socket_unixproute_only”, to only allow TCP/IP to be used inside the jail.
Now, if we want to administer the jail without using SSH, we can always use the jexec command.
# jexec 1 /bin/sh
# mkdir /usr/jail/server1/usr/ports
# mount_nullfs /usr/ports /usr/jail/server1/usr/ports
If for any reason that you need to find processes in the jail, do a “ps ax | grep J” in a shell of the main system.
Now that we have the jail setup, let’s say we did something wrong, and needed to stop the jail, and it wasn’t started via the rc.conf file. First we need to find the pid’s of the processes. Simply do:
# ps ax | grep J
This will list all the processes in a “J”ailed environment. Kill the processes, and now you can start your jail again correctly. Now, Let’s say the jail was started by the rc.conf. This makes it quite a bit simpler. Remember, in the rc.conf examples above, we named the jail “jail1”. We can stop the jail by doing:
# /etc/rc.d/jail stop jail1
We can also start the jail with this command as well:
# /etc/rc.d/jail start jail1
Now you should be all ready to go with your jail, and many more to come. Be sure that your network service applications in the jail are listening to the aliased IP, otherwise you might have issues connecting to the server with those services. In this sort of setup, you shouldn’t have too much of a problem.