Re: Problems with JAIL in 4.8R

From: stakys (stakys_at_punktas.lt)
Date: 08/05/03

  • Next message: FreeBSD Security Advisories: "FreeBSD Security Advisory FreeBSD-SA-03:08.realpath [REVISED]"
    To: <freebsd-security@freebsd.org>
    Date: Tue, 5 Aug 2003 14:53:39 +0300
    
    

    sockstat -4l | grep sshd
     root sshd 76407 3 tcp4 Jailed_system_outside_ip:22 *:*
     root sshd 111 4 tcp4 *:22 *:*

     I get this...
     Btw: i have just that firewall rules for testing if it's not ipfw fault.
     Also as i see for now i need to set for my main system and for jail'ed
     system to ListenAddress options yes?
     Ok i tried to do so, and changed ListenAddress parameter in jail'ed and
    main
     system sshd_config, the sockstat shows:
     root sshd 294 3 tcp4 Jailed_system_outside_ip:22 *:*
     root sshd 111 3 tcp4 Main_system_outside_ip:22 *:*
     But when i tried to connect to the jail'ed system from outside i get the
     message of connection timed out.

    > ----- Original Message -----
    > From: "Sander de Leeuw" <sander@delete-it.nl>
    > To: <stakys@punktas.lt>
    > Sent: Tuesday, August 05, 2003 1:22 PM
    > Subject: RE: Problems with JAIL in 4.8R
    >
    >
    > >
    > > Hi,
    > >
    > > I'm not really sure about this, just writing what comes up in my mind. I
    > > also have running jails in FreeBSD 4.8, and one is running sshd without
    > > problems. First of all, I assume that you followed the procedure
    > > explained in 'man jail'. It is important to be sure that if you run some
    > > sort of daemon in a jail, while running the same daemon in you're host
    > > environment, they do NOT bind on the same TCP socket. So, doing a
    > > 'sockstat -4l | grep sshd' should return something like this:
    > >
    > > root sshd 19906 3 tcp4 192.168.25.16:22 *:*
    > > root sshd 116 3 tcp4 192.168.25.1:22 *:*
    > >
    > > AND NOT:
    > >
    > > root sshd 19906 3 tcp4 192.168.25.16:22 *:*
    > > root sshd 116 3 tcp4 *:22 *:*
    > >
    > > In this case you should set the ListenAddress parameter in you're
    > > /etc/ssh/sshd_config file.
    > >
    > > I hope you can do something with it, good luck.
    > > Sander de Leeuw
    > > sander@delete-it.nl
    > >
    > >
    > > -----Oorspronkelijk bericht-----
    > > Van: owner-freebsd-security@freebsd.org
    > > [mailto:owner-freebsd-security@freebsd.org] Namens stakys@punktas.lt
    > > Verzonden: dinsdag 5 augustus 2003 14:57
    > > Aan: freebsd-security@freebsd.org
    > > Onderwerp: Problems with JAIL in 4.8R
    > >
    > > Hi, i've set the outside ip for the jail..It works.. When i try to ssh
    > > to
    > > jail'ed system from the main system (in which is created jail) the
    > > connection is successful, but when i try to connect to jailed system
    > > from
    > > anywhere else i get this message:
    > > ssh: connect to host IP_NUMBER port 22: Operation timed out
    > > What can be wrong here? How to solve this problem?
    > > _______________________________________________
    > > freebsd-security@freebsd.org mailing list
    > > http://lists.freebsd.org/mailman/listinfo/freebsd-security
    > > To unsubscribe, send any mail to
    > > "freebsd-security-unsubscribe@freebsd.org"
    > >
    > >
    >

    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"


  • Next message: FreeBSD Security Advisories: "FreeBSD Security Advisory FreeBSD-SA-03:08.realpath [REVISED]"

    Relevant Pages

    • Re: is one of my hosts a scanner?
      ... Use lsof or sockstat ... ; NKritsky ... To unsubscribe, ...
      (FreeBSD-Security)
    • Re: sockstat weirdness
      ... Jiawei Ye wrote: ... > leafy@chihiro:~$ sockstat ... fix it yourself? ... To unsubscribe, ...
      (freebsd-current)
    • Re: connections to 16001
      ... try sockstat to see 127.0.0.1 assiocate to some daemon or whatever ... > I have a bunch of those: ... > port, is esd, some kind of sound daemon from gnome or maybe enlightment. ...
      (FreeBSD-Security)
    • Re: unexpected trafic
      ... > My freebsd5.1 emits some trafic: ... Does sockstat show which process is using port 52075? ... To unsubscribe, ...
      (freebsd-hackers)
    • sockstat -6
      ... I get a mismatch error when i run sockstat -6. ... sockstat: struct xtcpcb size mismatch ... To unsubscribe, ...
      (freebsd-current)