Shared authentication across FreeBSD Jails

Question

I am using FreeBSD with ZFS to run several jails. For jail management I'm using ezjail, and I have a template jail which I use for provisioning.

I want to share passwd, groups, and authentication information across all jails and the host. For the jails it can be read-only.

Is there some mechanism which can share the host passwd, groups, etc. without any complex system such as LDAP/NIS/etc.?

score 2 · Accepted Answer · answered Feb 25 '13 at 16:55

LDAP or NIS is the Right Solution -- it's really not that complicated, and you should take a day and learn both (figure about half a day each to get the basics. Less if you buy the O'Reilly NIS book & LDAP book.
The big advantage here is you can centralize some accounts (administrative access/support users), authorize others on a per-jail basis, and still have local users on specific machines.

If you're really dead-set against LDAP or NIS the next best thing is to use Puppet, Chef, radmind, or similar to update the passwd and group files -- you can automatically synchronize the authentication/authorization files as part of a site-wide deployment process.
Automatic deployment tools have their own complexity issues, but also bring a number of benefits which may make them appropriate for your environment

The next step down is a cron job on the host system that copies standard passwd and group files to each jail at a set time. This is the simplest solution and works very well, though it is only a very small step up from copying the files yourself manually.

I know LDAP & NIS, but I simply would rather avoid it. `radmind` seems good, I was considering `rdist` aswell. But I thought there would exist a self-contained solution. — n n, Feb 26 '13 at 05:34
Is there a particular reason you want to avoid both of the standard, well-tested, generally-accepted-as-best-practice solutions? — voretaq7, Feb 26 '13 at 16:12
Thanks @voretaq7, I just wanted a simplistic solution, I think I'll settle on cronjobs. — n n, May 16 '13 at 15:41

score 1 · Answer 2 · edited Feb 25 '13 at 03:03

1

You could try hardlinks (ln(1)).

edited Feb 25 '13 at 03:03

EEAA

109,363
18
175
245

answered Feb 25 '13 at 02:40

abbe

356
1
12

These jails are using ZFS, and so hard links do not cross filesystems. – n n Feb 25 '13 at 02:51

score -1 · Answer 3 · edited Mar 10 '13 at 13:36

-1

If I remember right, then ezjail sets up a lot of directories and files in the default jail, that are shared across the other jails. I guess you could put users in there too. Maybe it's a bit of analysis first and manual work then.

But to be honest, I think this ruins your jails security. I normally create a jail to isolate as much as possible.

edited Mar 10 '13 at 13:36

j0k

411
9
16

answered Mar 10 '13 at 13:07

Sascha

101
1

This would provision the initial users and groups, but would not keep them synchronized. – Chris S Mar 10 '13 at 13:55
You're right, thanks! I missed that point. One more reason to not do it at all (from a security perspective) – Sascha Mar 10 '13 at 14:01

Shared authentication across FreeBSD Jails

3 Answers3