UCH

FreeBSD is a method used to create a virtual system within our system. The systems created with this method are completely independent from the main system. In this way, they are not affected by a possible security vulnerability. Also, when a service running in the jail is compromised, the services running on the main system are not affected.

Jails can be thought of as a kind of operating system-level virtualization.

It is a system that makes FreeBSD stand out from other operating systems in terms of security.

Bu sayfada anlatılan installation and usage information. It is about creating a completely separate structure called Thick Jail.

In addition, VNET features will be used to enable Jails to run on a separate network.

The installed jail will have all the basic FreeBSD files.

Jail installation steps can be listed as follows.

1. Creation of folders.
2. Downloading the required base archive.
3. Making settings on the main system.
4. Creating and editing jail configuration files.

Jails do not have to be kept in a specific directory. The script will use the directory /usr/jails. You can change it if you want…

Run and create the folders by changing the necessary places in the command below.

mkdir -p /usr/jails/files
mkdir /usr/jails/__JAIL_NAME__

The downloaded files will be kept in /usr/jails/files to avoid re-downloading them when needed.

You can use it to quickly install a new jail if needed. However, if you are short on space, you can download these files again for each jail installation.

• Edit and run the command below to download the necessary files.

fetch https://download.freebsd.org/ftp/releases/__ARCHITECTURE__/__ARCHITECTURE__/__VERSION__/base.txz -o /usr/jails/files/__VERSION__-__ARCHITECTURE__-base.txz

Example;

fetch https://download.freebsd.org/ftp/releases/i386/i386/13.2-RELEASE/base.txz -o /usr/jails/files/13.2-RELEASE-i386-base.txz

• Edit and run the following command to extract the downloaded base archive to the relevant jail location.

tar -xpf /usr/jails/files/__VERSION__-__ARCHITECTURE__-base.txz -C /usr/jails/__JAIL_NAME__ --unlink

Example;

tar -xpf /usr/jails/files/13.2-RELEASE-i386-base.txz -C /usr/jails/uch32bitjail --unlink

• If you are low on disk space, you can run the following command to delete the downloaded files. To install a new jail you will need to download it again.

rm -f /usr/jails/files/__VERSION__-__ARCHITECTURE__-base.txz

Example;

rm -f /usr/jails/files/13.2-RELEASE-i386-base.txz

For jails to work, some adjustments need to be made on the main system.

• The internet connection and time settings for Jail need to be copied directly from the main system. Edit and run the following command.

cp /etc/resolv.conf /usr/jails/__JAIL_NAME__/etc/resolv.conf
cp /etc/localtime /usr/jails/__JAIL_NAME__/etc/localtime

Örnek;

cp /etc/resolv.conf /usr/jails/uch32bitjail/etc/resolv.conf
cp /etc/localtime /usr/jails/uch32bitjail/etc/localtime

• Edit and run the following command to get possible updates for Jail.

freebsd-update -b /usr/jails/__JAIL_NAME__/ fetch install

Örnek;

freebsd-update -b /usr/jails/uch32bitjail/ fetch install

• If you want the jails to start automatically when the machine starts, run the following command.¹⁾

sysrc jail_enable="YES" # Initially to start the jails.
sysrc jail_parallel_start="YES" # If you add this line, the jails will be started in the background.

The jail prepared in this article is prepared completely independently from the main system. Therefore, the jail needs to run on a separate network. VNET will be used for this.

If you don't want your jail to have internet access via a separate network ²⁾ you can skip this part.

• Run the following command to create an adapter bridge.

ifconfig bridge create

It should give you an output. This output contains the name of the bridge adapter. Make a note of this name.

As an example bridge0

• Once the bridge is created, it will be necessary to add it to the em0 interface by running the following command:

Here em0 is the adapter name of the device. This name may be different in your system. You can use the ifconfig command to find out.

Below is a sample output. You can see the name in the highlighted line.

em0: flags=8863<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=481009b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,VLAN_HWFILTER,NOMAP>
        ether 08:00:27:06:c2:65
        inet 192.168.1.47 netmask 0xffffff00 broadcast 192.168.1.255
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

• Run the following command and add the bridge to interface em0. Here bridge0 is the bridge name created in the previous command and em0 is the network interface on the host system.

ifconfig bridge0 addm em0

• Add the following lines to the /etc/rc.conf file so that this happens automatically on every startup.

defaultrouter="192.168.1.1"
cloned_interfaces="bridge0"
ifconfig_bridge0="inet 192.168.1.150/24 addm em0 up"

There are two ways to set configuration files for jails. If you are going to use a lot of jails, it makes more sense to choose the second way.

Configuration information is kept in a single file. This file is /etc/jail.conf.

You need to add new entries to this file for each new jail.

Configuration information is kept in a separate file for each jail. These files are kept in the /etc/jail.conf.d/ folder.

For each new jail you need to create a new file in this folder. This method avoids confusion if you have many jails.

Open the configuration file according to the selected method and add the highlighted lines by editing them.

Detailed information is written next to them as a comment.

/etc/jail.conf

__JAIL_NAME__ { # Jail'in ismi
  exec.start = "/bin/sh /etc/rc"; # Jail başlatıldığında çalıştırılacak olan komutlar.
  exec.stop = "/bin/sh /etc/rc.shutdown"; # Jail kapatıldığında çalıştırılacak olan komutlar.
  exec.consolelog = "/var/log/jail_console_${name}.log"; # Komu çıktılarının yazılacağı dosya.
 
  allow.raw_sockets; # Raw soketlerin kullanılmasına izin verir. (ping gibi)
  exec.clean; # Komutları temiz bir ortamda çalıştırılması.
  mount.devfs; # /dev dizinine bir devfs(5) dosya sistemi ekleme.
 
  host.hostname = "${name}"; 
  path = "/usr/jails/${name}"; # Komutların çalıştırılacağı dizin. Kısaca jail'in kurulu olduğu dizin.
 
  vnet;
  vnet.interface = "${epair}b";
  $id = "154"; # Ip adresinin son kısmını hesaplayacak olan değer. Her jail için farklı olmalıdır.
  $ip = "192.168.1.${id}/24";
  $gateway = "192.168.1.1";
  $bridge = "bridge0"; # vnet ayarlamalarında oluşturulan köprü ismi.
  $epair = "epair${id}";
  exec.prestart += "ifconfig ${epair} create up";
  exec.prestart += "ifconfig ${epair}a up descr jail:${name}";
  exec.prestart += "ifconfig ${bridge} addm ${epair}a up";
  exec.start    += "ifconfig ${epair}b ${ip} up";
  exec.start    += "route add default ${gateway}";
  exec.poststop = "ifconfig ${bridge} deletem ${epair}a";
  exec.poststop += "ifconfig ${epair}a destroy";
}

• You can use the following command to list the jails currently running on the system.

jls

• You can use the command below to start Jail. If you have not set it to autostart at startup, you will have to use the command below.

service jail start __JAIL_NAME__
service jail onestart __JAIL_NAME__

• You can use the following command to stop the jail.

service jail stop __JAIL_NAME__

• You can use the following command to restart Jail.

service jail restart __JAIL_NAME__

• First stop the jail you are going to delete. Then run the command below according to your jail and change the file flags.

chflags -R 0 /usr/jails/__JAIL_NAME__

• You can now delete the jail folder with the following command.

rm -rf /usr/jails/__JAIL_NAME__

• Finally, complete the deletion process by deleting the configuration file for the relevant jail. If you configured with the first way. Edit the /etc/jail.conf file. If you configured with the second way. Delete the file /etc/jail.conf.d/JAIL_NAME.conf.

If you have not given internet access to your jail.³⁾ You can use the following command to install packages from the main system to jail.

pkg -j __JAIL_NAME__ install __PACKET_NAME__

Example;

pkg -j uch32bitjail install wget

Although it is more convenient to manage the jail through the main system, you can access the jail with the following command.

jexec -u root __JAIL_NAME__

To run a command on Jail, you need to add the following prefix to the command you will run.

jexec -l __JAIL_NAME__ __COMMAND__

Örnek;

jexec -l uch32bitjail service stop apache24

Taken from UCH Wiki. https://wiki.ulascemh.com/doku.php?id=en:cs:op:bsd:jail