Re: 'jailer' for managing jails

From: Marcio d'Avila Scheibler (marcio@cpd.ufsm.br)
Date: 05/23/02


Date: Thu, 23 May 2002 09:11:45 -0300 (GRNLNDST)
From: Marcio d'Avila Scheibler <marcio@cpd.ufsm.br>
To: Nielsen <nielsen@memberwebs.com>


I've read your manpage and found it interesting.
Some time ago I wrote some scripts to help jail configuration
and management, but I think for start and stop your
solution seems to be cleaner.

For those scripts I have an text file called "jailtab", where
each line defines one jail, with following fields:

- jail hostname
- jail root dir
- jail ip address
- jail default started command ("/bin/sh /etc/rc", but from
now "/usr/local/sbin/jailer" :-) )

This file prevents you from needing to enter all those parameters
whe using the scripts.

By the way, scripts are the following:

- jail-start <hostname> [command] # starts the jail
- jail-stop <hostname> # needs HOST (not jail) /proc
- jail-procfs <hostname} [mount|umount] # (u)mounts jail /proc

- jail-install
Performs "make install" from host /usr/src as is told in
jail manpage

- jail-config
Performs some config steps as is told in jail manpage (timezone,
root password, etc...) and also copies a list of files
defined in a "filelist" config file.

Let me now if you have interest in add and improve this
modest contrib, I send you a tarball with scripts and sample
"jailtab" file. In this case feel free to change jail-start
and jail-stop to handle "jailer"...

On Wed, 22 May 2002, Nielsen wrote:

> Date: Wed, 22 May 2002 22:30:02 -0700 (PDT)
> From: Nielsen <nielsen@memberwebs.com>
> To: freebsd-security@FreeBSD.ORG
> Subject: 'jailer' for managing jails
>
> Since the discussion here often revolves around jails, here's something I
> put together for managing jails. Comments welcome.
>
> http://memberwebs.com/nielsen/freebsd/jailer/
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>
>

------------------------------------------------------------------------------
Marcio d'Avila Scheibler - Divisao de Suporte (marcio@cpd.ufsm.br)
Centro de Processamento de Dados - Campus Universitario - CEP 97105-900
Universidade Federal de Santa Maria - RS - Brasil
=============================================================================

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message



Relevant Pages

  • Re: Secure shared web hosting using MAC Framework
    ... I am looking at securing a web server using the FreeBSD MAC Framework. ... run the web server and web users shell in a jail, ... Those rights should have priority on any traditional unix file ... Web users and executed web scripts shouldn't be able to read ...
    (FreeBSD-Security)
  • Re: Secure shared web hosting using MAC Framework
    ... I am looking at securing a web server using the FreeBSD MAC Framework. ... run the web server and web users shell in a jail, ... Those rights should have priority on any traditional unix file ... Web users and executed web scripts shouldn't be able to read ...
    (FreeBSD-Security)
  • Re: jails periodic stuff
    ... > the mentioned scripts won't ever be allowed to run inside a jail anyway ... > would be a good thing to simply disable them in jail environnement. ... installation, and this causes spurious error mails to be sent out every day" ... disables those tasks that send out spurious mails. ...
    (freebsd-current)
  • Re: jails periodic stuff
    ... > I don't see this as a problem, I see it as correct behaviour. ... > I wouldn't expect to see magic in these scripts saying ... > jail installation is just a normal FreeBSD installation, ... > So for me the obvious solution is to make a jail installation slightly ...
    (freebsd-current)
  • Re: jails periodic stuff
    ... > Note that I'm still not sure about these scripts: ... a mail being sent to the jail owner. ... system administrator would decide to open up direct access to a particular ... jail who is going to be responsible for the good health of the drives, ...
    (freebsd-current)