Questions tagged [jail]

"The FreeBSD jail mechanism is an implementation of operating system-level virtualization that allows administrators to partition a FreeBSD-based computer system into several independent mini-systems called jails." source: Wikipedia

A jail is characterized by four elements:

  • A directory subtree -- the starting point from which a jail is entered. Once inside the jail, a process is not permitted to escape outside of this subtree. Traditional security issues which plagued the original chroot(2) design will not affect FreeBSD jails.

  • A hostname -- the hostname which will be used within the jail. Jails are mainly used for hosting network services, therefore having a descriptive hostname for each jail can really help the system administrator.

  • An IP address -- this will be assigned to the jail and cannot be changed in any way during the jail's life span. The IP address of a jail is usually an alias address for an existing network interface, but this is not strictly necessary.

  • A command -- the path name of an executable to run inside the jail. This is relative to the root directory of the jail environment, and may vary a lot, depending on the type of the specific jail environment.

source: https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/jails.html#jails-synopsis

Links

76 questions
18
votes
1 answer

What's the difference between a Linux chroot jail and a FreeBSD jail?

What's the difference between a Linux chroot jail and a FreeBSD jail? Are they synonyms in modern systems? Is one more secure than the other? Is one more flexible?
Nektarios
  • 10,173
  • 8
  • 63
  • 93
13
votes
2 answers

Python: Securing untrusted scripts/subprocess with chroot and chjail?

I'm writing a web server based on Python which should be able to execute "plugins" so that functionality can be easily extended. For this I considered the approach to have a number of folders (one for each plugin) and a number of shell/python…
BastiBen
  • 19,679
  • 11
  • 56
  • 86
9
votes
5 answers

FreeBSD: jail can not set security.jail.sysvipc_allowed

There is a problem when I init a PostgreSQL database in a FreeBSD jail. I found an article about the problem. I tried its advice but I didn't have any luck and I don't know why. There is the link: PostgreSQL in jail . I also read the PostgreSQL…
randomness2077
  • 1,119
  • 2
  • 13
  • 25
7
votes
3 answers

Running arbitrary unfriendly Python code on my server

I'm making a game where users can write Python programs to control robots that fight each other. Every turn (in a thousand-turn game) their script will be run on my server to determine the robot's next move. How can I prevent these users from being…
user2058002
6
votes
2 answers

PHP jailing arbitrary code

We have a Java IRC application where users are allowed to execute arbitrary PHP and get the result. Here is one example of what this is used for: btc: $btc = json_decode(file_get_contents('https://btc-e.com/api/2/1/ticker'), true); $ticker =…
Riking
  • 2,389
  • 1
  • 24
  • 36
5
votes
6 answers

How to jail linux user

Is there something similar to chroot, but for users? We are about to grant access to our servers for a client and would like them to see only the directories we allow.
Andrei Serdeliuc ॐ
  • 5,828
  • 5
  • 39
  • 66
4
votes
2 answers

Securing git server

I setup a git server over ssh as http://blog.commonthread.com/post/1034988660/setting-up-a-git-server However, I am still able to access the server by ssh and see all the folders on the server. How do you usually secure the server so that the git…
jimiyash
  • 2,494
  • 2
  • 20
  • 29
4
votes
1 answer

What is needed to run a Haskell program in a jailed environment

I want to run a simple Haskell program from a jailed environment that I construct myself. The following Haskell program I want to run: import System.IO main = do hPutStrLn stderr "test standard error!" hPutStrLn stdout "test standard…
AIJim
  • 73
  • 3
4
votes
1 answer

Configuring devices in chroot-environment OpenBSD

I have been scratching my head for a while now and cannot find a way to make it work... I want to run some cgi scripts (written in Python) on my OpenBSD server. Since the web-server on OpenBSD runs in a jail I recreated the whole folder structure…
TDrabas
  • 858
  • 6
  • 13
4
votes
2 answers

Python error when runs in chroot

I try to run some Python programs in chroot and I get the following error Could not find platform independent libraries Could not find platform dependent libraries Consider setting $PYTHONHOME to…
Paris
  • 6,323
  • 7
  • 31
  • 49
3
votes
2 answers

Host-only networking for FreeBSD jails

I have inherited an environment with multiple FreeBSD6.1 machines running jails. Due to IP exhaustion on the local network, I want to change the jails so that there is 1 routable IP on the physical network, and another non-routable virtual network…
BSD Bertie
  • 31
  • 2
3
votes
2 answers

FreeBSD jails and Sockets

I'm quite new to freeBSD switching from Linux. I read about jail, the solution sound great for Server Systems. So my idea for my webserver was to create 3 jails. One jail for mysql, one for nginx and one for php-fpm. Now the jails have to…
Johannes
  • 31
  • 1
  • 2
3
votes
1 answer

Limit SSH - bash with no commands

So I have been working on this for some time. Would like to know if there is a better way or if I am on the right track. I would basically like to allow some users to login to my server via SSH and then have a squid tunnel via that SSH…
David
  • 33
  • 5
3
votes
2 answers

Making an npm script auto start in a FreeBSD Jail

I've installed an npm package / script in a JAIL on FreeNAS 9.10. (FreeBSD based) It works perfectly if I run "npm start" in the directory where the scripts are installed. However, I need this to be auto-starting when the jail starts. I don't know…
bobomoreno
  • 2,848
  • 5
  • 23
  • 42
3
votes
2 answers

What is needed to create a jailed environment for Scala

I'm developer of a website where programmers can submit bots that compete against each other in a game. I'm trying to add Scala to our list of supported languages, but I'm having trouble here. The problem is that every bot runs from it's own jail…
AIJim
  • 73
  • 3
1
2 3 4 5 6