Questions tagged [jail]

"The FreeBSD jail mechanism is an implementation of operating system-level virtualization that allows administrators to partition a FreeBSD-based computer system into several independent mini-systems called jails." source: Wikipedia

A jail is characterized by four elements:

  • A directory subtree -- the starting point from which a jail is entered. Once inside the jail, a process is not permitted to escape outside of this subtree. Traditional security issues which plagued the original chroot(2) design will not affect FreeBSD jails.

  • A hostname -- the hostname which will be used within the jail. Jails are mainly used for hosting network services, therefore having a descriptive hostname for each jail can really help the system administrator.

  • An IP address -- this will be assigned to the jail and cannot be changed in any way during the jail's life span. The IP address of a jail is usually an alias address for an existing network interface, but this is not strictly necessary.

  • A command -- the path name of an executable to run inside the jail. This is relative to the root directory of the jail environment, and may vary a lot, depending on the type of the specific jail environment.

source: https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/jails.html#jails-synopsis

Links

76 questions
3
votes
1 answer

Fair, secure, efficient, and multi-lingual sandboxing

I'm working on developing a online-judge type system where maybe 100 or so untrusted executables will all be running simultaneously and evaluating the same input data. I'd like each executable to be limited to an equal share of CPU, memory, disk…
thinkski
  • 1,306
  • 1
  • 15
  • 25
3
votes
1 answer

How can I customize Capistranos SSH command?

In order to deploy into FreeBSD jails, I need my commands to look like this: ssh user@example.org "jexec 'web_jail' $THE_COMMAND_HERE" ssh user@example.org "jexec 'db_jail' $ANOTHER_COMMAND_HERE" ... Note that, though technically possible, I want…
user569825
  • 2,369
  • 1
  • 25
  • 45
2
votes
1 answer

Missing glyph character and garbage replace leading 5 characters of file name when written to disk

FreeBSD-12.1p5 vim-8.2 I have a zfs clone of an iocage thick jail that I am using for testing. When I open a file with vim in character mode and I use :wq to save my changes then I see these characters in place of those expected…
James B. Byrne
  • 1,048
  • 12
  • 27
2
votes
1 answer

Why poudriere creates a pair of jails with and without IP addresses

While testing a port using poudriere with something like this: poudriere testport -v -j 11amd64 -p custom www/go-www I got this error: !!! build failure encountered !!! [00:00:06] ====>> Error: Build failed in phase: fetch For…
nbari
  • 25,603
  • 10
  • 76
  • 131
2
votes
1 answer

FreeBSD jails mkstemp failed

I'm trying to install some stuff in my jails with this set up: I have make my own flavor of jails by following this howto: FreeBSD forum Everything worked fine for me so far, I have mounted /usr/ports with fstab to the jail, started the jail and…
2
votes
3 answers

FreeBSD Jail and SSH - /dev/tty: No such file or directory

When I try to connect through SSH from inside the JAIL I get this error: # ssh test@test.com ... debug1: read_passphrase: can not open / dev / tty: No such file or directory Host key verification failed. Outside JAIL everythng is working properly.…
Maciej Kucharz
  • 1,395
  • 1
  • 13
  • 17
2
votes
2 answers

Managing FreeBSD Jails programmatically

Is it possible to manage the FreeBSD jails programmatically (create jails, perform snapshots, etc)? I know there is a libjail, but I couldn't find any examples.
Nedo
  • 627
  • 1
  • 10
  • 20
2
votes
2 answers

Move a Sftp User in a Subdirectory of his Jail

I've a question concerning the Jail explained later: User to be jailed: foo Jail Directory: /mnt/foo-jail Home directory of foo: /mnt/foo-jail/foo-home Everything is ok. Jail is up and the user is connecting correctly. The problem is: "foo" has…
Echoes_86
  • 293
  • 3
  • 8
2
votes
2 answers

C++: Any way to 'jail function'?

Well, it's a kind of a web server. I load .dll(.a) files and use them as program modules. I recursively go through directories and put '_main' functors from these libraries into std::map under name, which is membered in special '.m' files. The main…
Ben Usman
  • 7,969
  • 6
  • 46
  • 66
2
votes
1 answer

git log command prints nothing in chroot

I made chroot jail using script make_chroot_jail.sh, then added git by copying /usr/bin/git*, all libraries that these binaries need and /usr/share/git-core now i can init, clone commit, push and so on in jail, but when i type git log it prints…
NightBlues
  • 23
  • 2
2
votes
1 answer

Clojure: light weight jail

Context: In Lua, it's trivial and very cheap (4kb of memory) to create a new Lua VM. Thus, it's trivial to create cheap lua "jails". Then, if the untrusted code misbehaves, I just kill the Lua VM. I'm aware of https://github.com/Licenser/clj-sandbox…
user1383359
  • 2,673
  • 2
  • 25
  • 32
1
vote
1 answer

Fail2Ban - How to block BruteForce on install.php files?

an IP address attack my server with BruteForce scanning of install.php Wordpress files: /var/www/vhosts/website1.tld/logs/access_ssl_log:104.248.227.52 - - [28/Jul/2021:08:27:33 +0200] "GET /wp-admin/install.php HTTP/1.1" 200 5503 "-" "Mozilla/5.0…
Kiuki
  • 624
  • 3
  • 7
  • 16
1
vote
2 answers

Multiple jails one public ipaddress no nat

My question is pretty simple. I have scoured the web and cannot discern from what i have read how to implement the following. My question is simple. Is the following possible and can someone point me to a thorough article discussing this? I am new…
1
vote
0 answers

docker on freebsd 11.1

I am trying to run docker on FreeBSD 11.1, but I am having issues in building my docker images, for example, if I use https://github.com/dockerfile/ubuntu/blob/master/Dockerfile and build it, I get the following error: khine@dhegdheer …
khinester
  • 3,398
  • 9
  • 45
  • 88
1
vote
0 answers

Installing Artifactory OSS port on FreeBSD jail

I have installed artifactory-5.4.1 on a FreeBSD 11.1 jail. I have localhost and a loopback interface defined, but its IP address is 127.0.0.169. When I install the artifactory package and attempt to start it, it fails to configure because it…
B Albrecht
  • 11
  • 2