A BSD Jail is a container which provides isolated environment for applications to run. Ezjail simplifies the process of installing and managing Jails.

Most of the posts on ezjail focus on downloading a FreeBSD basejail/template from internet.

I was curious on how can I use what is with me – a DVD .iso image of FreeBSD 10.2 RELEASE. Turns out it is not that hard and ezjail does support this.

This post is aimed to help users who are on a low bandwidth link or lack internet connectivity. I have used version 10.2 here, this might not work with earlier releases, and the following commands are executed as root user.

In the end we will have something like:

Logical diagram of what we will achieve.

Logical diagram of what we will achieve.

The diagram is a logical representation of what we will get.

Now to start with, after installing FreeBSD(ZFS recommended for production servers), and installing ezjail from the FreeBSD repo(http://pkg.freebsd.org/)  (in case you lack internet, you can download the ezjail package) mount the CD/DVD .iso image you have:

# mount -t cd9660 /dev/cd0 /media/optical/

OR

# mount_cd9660 /dev/cd0 /media/optical/

/dev/cd0 is for both CD or a DVD. You may have to create the optical/ directory under /media or /mnt.

If  there were no error messages then the disc was mounted.

Execute following to verify:

# mount
.
.
.
/dev/cd0 2.6G 2.6G 0B 100% /media/optical

OR

# df
.
.
.
/dev/cd0 2675856 2675856 0 100% /media/optical

The FreeBSD distribution which contains the base OS(in file base.txz) is  under usr/freebsd-dist on the optical media.

root@Zfreebsd:/media/optical/usr/freebsd-dist # ls
MANIFEST base.txz doc.txz games.txz kernel.txz lib32.txz ports.txz src.txz

root@Zfreebsd:/media/optical/usr/freebsd-dist # pwd
/media/optical/usr/freebsd-dist

Supply the above (absolute/full) path to ezjail-admin to create a basejail:

# ezjail-admin install-h file:///media/optical/usr/freebsd-dist

This will extract and install a base jail necessary to create other jails, to install man pages supply (-m):

# ezjail-admin install -m-h file:///media/optical/usr/freebsd-dist
.
.
.
/usr/jails/basejail/usr/lib32/libutempter.a
/usr/jails/basejail/usr/lib32/libuutil_p.a
146888 blocks
Note: a non-standard /etc/make.conf was copied to the template jail in order to get the ports collection running inside jails.

After this you can see the base jail created by ezjail under /usr/jails:

# ls -l /usr/jails/
total 18
drwxr-xr-x   9 root  wheel   9 Dec 12 15:28 basejail
drwxr-xr-x   3 root  wheel   3 Dec 12 15:28 flavours
drwxr-xr-x  12 root  wheel  22 Dec 12 15:28 newjail

You environment is now ready to create jails using this base jail.

Optional, update the basejail to latest patches:

# ezjail-admin update  -u

Creating a test jail

# ezjail-admin create testjail1 ’em0|10.0.2.16′
.
.
.
/usr/jails/testjail1/./.profile
6287 blocks
Warning: Some services already seem to be listening on all IP, (including 10.0.2.16)
This may cause some confusion, here they are:
root     ntpd       655   20 udp6   *:123                 *:*
root     ntpd       655   21 udp4   *:123                 *:*
root     syslogd    493   6  udp6   *:514                 *:*
root     syslogd    493   7  udp4   *:514                 *:*

To resolve the warning shown we need to limit what these services can listen on the host.

For ntpd it is difficult to do this, so either install net/openntpd or disable it in /etc/rc.conf:

#sysrc ntpd_enable=”NO”

 

# service ntpd onestop

 

For syslod there are flags to pass which will will bind it to the host address:
In /etc/rc.conf

syslogd_enable=”YES”
syslogd_flags=”-s -b 127.0.0.1″
#-s causes it to be in secure mode, -b to bind it to
#an address

Restart syslogd:

# service syslogd restart

Also change ssh configuration to listen only one select IP addresses:

ListenAddress xxx.xxx.xxx.xxx

Restart SSH after checking for errors:

# sshd -t

# service sshd restart

 

Now start the jail you created:

# ezjail-admin start testjail1

# ezjail-admin list

Get a shell in your new jail with the:

# ezjail-admin console testjail1

You can now install applications inside the jail. It is just like another FreeBSD machine.
Optional, To allow ping from inside jail:
You need to change settings on your host and on the jail.

On host:

# sysctl security.jail.allow_raw_sockets=1

For setting it permanently, modify /etc/sysctl.conf.

For the Jail on host:
Edit the ezjail config of the jail on the host:
For me it is /usr/local/etc/ezjail/testjail1, add following:

export jail_testjail1_parameters=”allow.raw_sockets”

OR

export jail_testjail1_parameters=”allow.raw_sockets=1″

To make this effective restart jail from the host:

# ezjail-admin restart testjail1

You can ping the jail from the host, and if the jail was assigned an IP address on the same subnet as other machines on the network, you can ping this IP from the machines.

In the next post I will detail on how to provide NAT connections to the jails, NAT is required to provide internet access the jails and redirection to provide access to external world to the service running on your jail.

 

Advertisements