Jails - Revision history

173.88.199.104 at 01:09, 10 August 2012

2012-08-10T01:09:13Z

173.88.199.104 at 01:03, 10 August 2012

2012-08-10T01:03:09Z

145.94.33.175: /* Creating the jail */

2007-09-09T11:12:15Z

Creating the jail

145.94.33.175: /* Creating the jail */

2007-09-09T11:08:54Z

Creating the jail

145.94.33.175: /* Minor edit */

2007-08-23T13:18:33Z

Minor edit

Gvtjongahung: /* Creating service jails */

2007-08-22T22:39:02Z

Creating service jails

New page

A dedicated machine for a server is a costly thing. For a server which is not often used, it is desirable to still be able to use the same machine, but without the drawbacks of having all the servers on one installation. These are sometimes limited via chrooted servers. A better way is with the help of a jail.

== Creating the jail ==

Install cpdup ({PORTSDIR}/sysutils/cpdup)
# pkg_add -r cpdup
Alternatively if that doesn't work try:
# cd {PORTSDIR}/sysutils/cpdup && make install clean

Next create a template:
# mkdir /usr/jail /usr/jail/mroot
# cd /usr/src
# make installworld DESTDIR=/usr/jail/mroot
# cpdup /usr/src /usr/jail/mroot/usr/src

# mkdir /usr/jail/skel /usr/jail/skel/home /usr/jail/skel/distfiles
# mv etc /usr/jail/skel
# mv usr/local /usr/jail/skel/usr-local
# mv tmp /usr/jail/skel
# mv var /usr/jail/skel
# mv root /usr/jail/skel
# mergemaster -t /usr/jail/skel/var/tmp/temproot -D /usr/jail/skel -i
# cd /usr/jail/skel
# rm -R bin boot lib libexec mnt proc rescue sbin sys usr dev
# cd /usr/jail/mroot
# mkdir /usr/ports
# mkdir s
# ln -s s/etc etc
# ln -s s/home home
# ln -s s/root root
# ln -s ../s/usr-local usr/local
# ln -s ../s/usr-X11R6 usr/local
# ln -s ../../s/distfiles usr/ports/distfiles
# ln -s s/tmp tmp
# ln -s s/var var

Edit /etc/rc.conf:
jail_enable="YES"
jail_set_hostname_allow="NO"
jail_list="{server1} {server2}"
jail_devfs_enable="YES"

Search man 5 rc.conf for more jail settings
If you would like to have some standard configuration settings for (almost) all jails modify the files in /usr/jail/skel.

Create a jail skeleton

# mkdir /usr/jails

For every server:
* Edit /etc/fstab on your host system:
/usr/jail/mroot /usr/jail/{server} nullfs ro 0 0
/usr/jails/{server} /usr/jail/{server}/s nullfs rw 0 0
* Create the mount-points
# mkdir /usr/jail/{server}
# cpdup /usr/jail/skel /usr/jails/{server}

* Edit /etc/rc.conf:

jail_{server}_hostname="server.example.org"
jail_{server}_ip="192.168.x.x"
jail_{server}_rootdir="/usr/jail/{server}"

Finally mount the jails and start them.

# mount -a
# /etc/rc.d/jail start

They should be running now and you should be able to see them by typing:
jls
If you wish to access the system type:
jexec tcsh {JID}

One often creates a build jail in which one creates the packages for the separate jails creating less "pollution" in your jails.
One can now install the packages for the jail.

[[Category: Configuring FreeBSD]]

← Older revision		Revision as of 01:09, 10 August 2012
Line 1:		Line 1:
−	A dedicated machine for a server is a costly thing. For a server which is not often used, it is desirable to still be able to use the same machine, but without the drawbacks of having all the servers on one installation. These are sometimes limited via chrooted servers. A better way is with the help of a jail. This was written in 2007, its now 2012 and a lot things have changed since 2007. There is now a port system utility called qjail	+	A dedicated machine for a server is a costly thing. For a server which is not often used, it is desirable to still be able to use the same machine, but without the drawbacks of having all the servers on one installation. These are sometimes limited via chrooted servers. A better way is with the help of a jail.<br>
		+	<br>
		+	NOTE: This was written in 2007, its now 2012 and a lot things have changed since 2007. There is now a port system utility called qjail which greatly simplifies jail creation and administration.<br>
		+	<br>
		+	'''Full details can be found on the
		+	[http://qjail.sourceforge.net/ qjail project website].'''
		+

@@ Line 1: / Line 1: @@
-A dedicated machine for a server is a costly thing. For a server which is not often used, it is desirable to still be able to use the same machine, but without the drawbacks of having all the servers on one installation. These are sometimes limited via chrooted servers. A better way is with the help of a jail.
+A dedicated machine for a server is a costly thing. For a server which is not often used, it is desirable to still be able to use the same machine, but without the drawbacks of having all the servers on one installation. These are sometimes limited via chrooted servers. A better way is with the help of a jail. This was written in 2007, its now 2012 and a lot things have changed since 2007. There is now a port system utility called qjail
-== Creating the jail ==
+== Creating a jail [manual method] ==
 Install cpdup ({PORTSDIR}/sysutils/cpdup)

@@ Line 56: / Line 56: @@
 For every server:
 * Edit /etc/fstab on your host system:
-/usr/jail/mroot       /usr/jail/{server}     nullfs  ro  0   0
+ /usr/jail/mroot       /usr/jail/{server}     nullfs  ro  0   0
-/usr/jails/{server}   /usr/jail/{server}/s   nullfs  rw  0   0
+ /usr/jails/{server}   /usr/jail/{server}/s   nullfs  rw  0   0
 * Create the mount-points
 # mkdir /usr/jail/{server}

@@ Line 16: / Line 16: @@
   # mkdir /usr/jail/skel /usr/jail/skel/home /usr/jail/skel/distfiles
   # mv etc /usr/jail/skel
   # mv usr/local /usr/jail/skel/usr-local
@@ Line 25: / Line 26: @@
   # rm -R bin boot lib libexec mnt proc rescue sbin sys usr dev
   # cd /usr/jail/mroot
-  # mkdir /usr/ports
+  # mkdir usr/ports
   # mkdir s
   # ln -s s/etc etc
@@ Line 31: / Line 32: @@
   # ln -s s/root root
   # ln -s ../s/usr-local usr/local
-  # ln -s ../s/usr-X11R6 usr/local
+  # ln -s ../s/usr-local usr/X11R6
   # ln -s ../../s/distfiles usr/ports/distfiles
   # ln -s s/tmp tmp
@@ Line 46: / Line 47: @@
 In /etc/rc.conf set
   rpcbind_enable="NO"

@@ Line 43: / Line 43: @@
 Search man 5 rc.conf for more jail settings
-If you would like to have some standard configuration settings for (almost) all jails modify the files in /usr/jail/skel.
+If you would like to have some standard configuration settings for (almost) all jails modify the files in /usr/jail/skel. (e.g. /etc/resolve.conf)
@@ Line 77: / Line 81: @@
 One can now install the packages for the jail.
 [[Category: Configuring FreeBSD]]