pavement

Jails

From FreeBSDwiki
(Difference between revisions)
Jump to: navigation, search
(Creating service jails)
 
(Minor edit)
Line 43: Line 43:
  
 
Search man 5 rc.conf for more jail settings
 
Search man 5 rc.conf for more jail settings
If you would like to have some standard configuration settings for (almost) all jails modify the files in /usr/jail/skel.
+
If you would like to have some standard configuration settings for (almost) all jails modify the files in /usr/jail/skel. (e.g. /etc/resolve.conf)
 +
In /etc/rc.conf set
 +
rpcbind_enable="NO"
 +
 
 +
 
  
  
Line 77: Line 81:
 
One can now install the packages for the jail.
 
One can now install the packages for the jail.
  
 +
For more information see:
 +
man 8 jail
 
[[Category: Configuring FreeBSD]]
 
[[Category: Configuring FreeBSD]]

Revision as of 09:18, 23 August 2007

A dedicated machine for a server is a costly thing. For a server which is not often used, it is desirable to still be able to use the same machine, but without the drawbacks of having all the servers on one installation. These are sometimes limited via chrooted servers. A better way is with the help of a jail.


Creating the jail

Install cpdup ({PORTSDIR}/sysutils/cpdup)

# pkg_add -r cpdup 

Alternatively if that doesn't work try:

# cd {PORTSDIR}/sysutils/cpdup && make install clean

Next create a template:

# mkdir /usr/jail /usr/jail/mroot
# cd /usr/src
# make installworld DESTDIR=/usr/jail/mroot
# cpdup /usr/src /usr/jail/mroot/usr/src
# mkdir /usr/jail/skel /usr/jail/skel/home /usr/jail/skel/distfiles
# mv etc /usr/jail/skel
# mv usr/local /usr/jail/skel/usr-local
# mv tmp /usr/jail/skel
# mv var /usr/jail/skel
# mv root /usr/jail/skel
# mergemaster -t /usr/jail/skel/var/tmp/temproot -D /usr/jail/skel -i
# cd /usr/jail/skel
# rm -R bin boot lib libexec mnt proc rescue sbin sys usr dev
# cd /usr/jail/mroot
# mkdir /usr/ports
# mkdir s
# ln -s s/etc etc
# ln -s s/home home
# ln -s s/root root
# ln -s ../s/usr-local usr/local
# ln -s ../s/usr-X11R6 usr/local
# ln -s ../../s/distfiles usr/ports/distfiles
# ln -s s/tmp tmp
# ln -s s/var var

Edit /etc/rc.conf:

jail_enable="YES"
jail_set_hostname_allow="NO"
jail_list="{server1} {server2}"
jail_devfs_enable="YES"

Search man 5 rc.conf for more jail settings If you would like to have some standard configuration settings for (almost) all jails modify the files in /usr/jail/skel. (e.g. /etc/resolve.conf) In /etc/rc.conf set

rpcbind_enable="NO"



Create a jail skeleton

# mkdir /usr/jails

For every server:

  • Edit /etc/fstab on your host system:

/usr/jail/mroot /usr/jail/{server} nullfs ro 0 0 /usr/jails/{server} /usr/jail/{server}/s nullfs rw 0 0

  • Create the mount-points
  1. mkdir /usr/jail/{server}
  2. cpdup /usr/jail/skel /usr/jails/{server}
  • Edit /etc/rc.conf:
jail_{server}_hostname="server.example.org"
jail_{server}_ip="192.168.x.x"
jail_{server}_rootdir="/usr/jail/{server}"

Finally mount the jails and start them.

# mount -a
# /etc/rc.d/jail start

They should be running now and you should be able to see them by typing:

jls

If you wish to access the system type:

jexec tcsh {JID}

One often creates a build jail in which one creates the packages for the separate jails creating less "pollution" in your jails. One can now install the packages for the jail.

For more information see:

man 8 jail
Personal tools