JAIL

JAIL

[FreeBSD]

portsをjail環境にも

mount_null /usr/ports /home/jail/usr/ports

/etc/fstabにnoautoで書いておくと、必要な時にjail内でportsのメンテが出来る。

/usr/ports /home/jail/usr/ports null rw,noauto 0 0

FreeBSD 5.1R jail

MAKEDEV jail

では無くてjail_*_devfs_rulesetで指定する。

/etc/rc.conf

jail_enable="YES"
jail_list="jailhost"
jail_set_hostname_allow="NO"
jail_socket_unixiproute_only="YES"
jail_sysvipc_allow="NO"
jail_stop_jailer="NO" # sysutils/jailer
jail_jailhost_rootdir="/path/to/jailhost"
jail_jailhost_hostname="jailhost.example.jp"
jail_jailhost_ip="192.168.HOGE.FUGA"
jail_jailhost_exec="/bin/sh /etc/rc"
jail_jailhost_devfs_enable="YES"
jail_jailhost_fdescfs_enable="NO"
jail_jailhost_procfs_enable="NO"
#jail_jailhost_devfs_ruleset="devfsrules_jail_jailhost"
#jail_jailhost_devfs_ruleset="devfsrules_jail_nologin_jailhost" # nologin devfs

/etc/devfs.rule

[devfsrules_jail_nologin=5]
add include $devfsrules_hide_all
add include $devfsrules_unhide_basic

5.1Rからのjail関連コマンド

• jexec(8)
• jls(8)

FreeBSD 4.8R jail

• JailAdmin
  • http://subwiki.honeypot.net/cgi-bin/view/Freebsd/JailAdmin

• FreeBSD Jail Software and Docs
  • http://memberwebs.com/nielsen/freebsd/jails/

• host

cd $jail_dir;ln -sf dev/null $jail_dir/kernel
echo 'jail.set_hostname_allowed=0' >> /etc/sysctl.conf
cp -p /etc/resolv.conf $jail_dir/etc
ln -sf /usr/share/zoneinfo/Asia/Tokyo $jail_dir/etc/localtime
touch $jail_dir/etc/wall_cmos_clock
cat /dev/null >$jail_dir/etc/fstab
echo '#proc	'$jail_dir/proc'	procfs	rw	0	0' >>/etc/fstab

in jail

• ConfigureJailEnvironment
  • http://subwiki.honeypot.net/cgi-bin/view/Freebsd/ConfigureJailEnvironment

以下の作業はchroot /home/jailかssh jailしてjail環境内で行う。

• 空ファイルをつくり、mountなどを無効化

ln -sf dev/null kernel
touch /etc/fstab
chflags noschg /sbin/init
rm /sbin/init
rm /sbin/mount
rm /sbin/umount
ln /usr/bin/true /sbin/init
ln /usr/bin/true /sbin/mount
ln /usr/bin/true /sbin/umount

• periodicをjail向けに変更

cd /etc
fetch http://memberwebs.com/nielsen/freebsd/jails/docs/4.7/periodic.conf
touch /var/log/wtmp

• atと時間調整をコメントアウト

vi /etc/crontab
commentout /usr/libexec/atrun
commentout adjkerntz

• jailに不必要なファイルを削除

cd /
fetch http://memberwebs.com/nielsen/freebsd/jails/docs/jail_remove.txt
chflags noschg /sbin/init /usr/sbin/sliplogin

jail_remove.txtから/mntと/procを削除して

cat jail_remove.txt | xargs rm -rf

• /etc/rc.conf

portmap_enable="NO"
network_interfaces=""
inetd_enable="NO"
sendmail_enable="NONE"
sshd_enable="YES"
sshd_flags="-4"
syslogd_flags="-ss"
tcp_keepalive="NO"
tcp_extensions="NO"

Link

• jman 8 jail
  • http://www.jp.freebsd.org/cgi/mroff.cgi?sect=8&cmd=&lc=1&subdir=man&dir=jpman-4.7.0%2Fman&subdir=man&man=jail

• FreeBSD-AT RANDOM jail環境の構築
  • http://www.f-bell.net/FreeBSD/jail.html

• JAIL SCRIPTS for FreeBSD
  • http://www.bichir.ddo.jp/bit/settings/jail_scripts.html

• jail/chroot mini tree 構築用 Makefile
  • http://www.cypac.co.jp/lib/index.html#jail

• FreeBSD PRESS掲載のjail構築スクリプト
  • http://sada.bsdclub.org/scripts/

• jail.sh
  • http://www.geocities.co.jp/AnimeComic-White/6586/firewall.html

• jailのmake installworld
  • http://motd.kanai.biz/2002/07/09.html

J=/here/is/jail
cd /usr/src
make installworld DESTDIR=$J
mergemaster -i -D $J -t $J/var/tmp/temproot
cd $J/dev
./MAKEDEV jail

• devfs in jail でお困りのこと。
  • http://www.mass.dnsalias.com/problem/devfs_in_jail.html

• jail 内の Ports を親環境から portaudit する
  • http://www.mass.dnsalias.com/archives/000495.html

• コンパクトなJail環境の構築
  • http://hk-tech.homeip.net/pcserver/jail.html

• ACM Queue - Building Systems to be Shared Securely - Running multiple virtual servers on one machine makes sense, but what happens when not everyone plays nice?
  • http://www.acmqueue.com/modules.php?name=Content&pa=showpage&pid=170

jail開発者のPoul-Henning Kampが書いた詳細な論文

• The FreeBSD Diary -- Using a jail as a virtual machine
  • http://www.freebsddiary.org/jail.php

• Subwiki . Freebsd . JailAdmin
  • http://subwiki.honeypot.net/cgi-bin/view/Freebsd/JailAdmin

• How to make a working jail
  • http://jailnotes.cg.nu/

BIND jail mini tree

http://gouketsu.net/simm/d/20021130.html#p01

EXTRAFILES=?
/usr/lib/libc.so.4 ?
/usr/libexec/ld-elf.so.1 

でmakejail.shを実行しても良い。

• chroot BIND9
  • http://homepage1.nifty.com/mobiuse/BIND9.htm

Squid jail

• http://www.f-bell.net/FreeBSD/squid.html

proftpd jail

• Lightweight FTP jail with NAT
  • http://www.jp.daemonnews.org/200212/ftpjail.html

cvsサーバー

• cvs サーバの構築
  • http://cvs.m17n.org/cvs/server.ja.html

• tcpserverとdaemontoolsでcvs pserver
  • http://www.gentei.org/~yuuji/rec/pc/memo/2004/05/29/

isc-dhcpd

• BSDHound How to chroot your existing isc-dhcpd server on freebsd
  • http://bsdhound.com/newsread.php?newsid=64

postfix-current

• Postfix in a FreeBSD jail
  • http://barnson.org/node/view/139