0

I want to torify my FreeBSD old machine purposed to mainly darknet activities. Questions:

Should I worry about these errors during creating jail?

Warning: Some services already seem to be listening on all IP, (including 127.0.1.1)
  This may cause some confusion, here they are:
root     ntpd       58008 20 udp6   *:123                 *:*
root     ntpd       58008 21 udp4   *:123                 *:*
root     lpd        48726 6  tcp6   *:515                 *:*
root     lpd        48726 7  tcp4   *:515                 *:*
Warning: Some services already seem to be listening on IP 192.168.1.105
  This may cause some confusion, here they are:
root     ntpd       58008 23 udp4   192.168.1.105:123     *:*
Warning: Some services already seem to be listening on all IP, (including 192.168.1.105)
  This may cause some confusion, here they are:
root     ntpd       58008 20 udp6   *:123                 *:*
root     ntpd       58008 21 udp4   *:123                 *:*
root     lpd        48726 6  tcp6   *:515                 *:*
root     lpd        48726 7  tcp4   *:515                 *:

Should jail have access to loopback interface and public Ethernet interface assuming that all traffic from this machine will be routed through Tor? Is it necessary to set up a virtual network interface to communicate between jails?

0

No - the jail does not need access to loopback or the public interface. And you can do without a virtual network interface (VNET/VIMAGE) unless you want to do VLAN tagging or more advanced stuff.

What I usually do is to clone the loopback interface. Then I have an internal interface only used for jails and jail traffic. And then I manage access using the pf firewall. You are not specific - but it looks like you are using the script ezjail. I just use what comes with the base system - but the concepts are the same. Many services you setup within the jails will reference *:port or 0.0.0.0:port. This will bind to any IP address available and you can see these errors. If you bind these services explicitly to the address available in the jail you will not see these errors.

My /etc/jail.conf looks like this:

# Global settings applied to all jails.
host.hostname = "${name}.jail";
interface = "lo1";
path = "/usr/local/jails/${name}";
mount.fstab = "/usr/local/jails/${name}.fstab";
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
exec.clean;
mount.devfs;

# Only needed for PostgreSQL:
# allow.sysvipc;

myjail1 { ip4.addr = 172.17.2.1; }
myjail2 { ip4.addr = 172.17.2.2; }
myjail3 { ip4.addr = 172.17.2.3; }

The lo1 is setup in /etc/rc.conf

cloned_interfaces="lo1"
ifconfig_lo1="inet 172.17.2.0 netmask 255.255.255.0"

Perviously I setup each IP individually in /etc/rc.conf but this is not really needed. The above 2 lines in /etc/rc.conf and referencing lo1 in /etc/jail.conf is enough. But if you want you can alias the addresses up front:

ifconfig_lo1_alias0="inet 172.17.2.1 netmask 255.255.255.255"
ifconfig_lo1_alias1="inet 172.17.2.2 netmask 255.255.255.255"
ifconfig_lo1_alias2="inet 172.17.2.3 netmask 255.255.255.255"

The exiting stuff then comes in /etc/pf.conf. You can use any names you want - but I default to these macros in the top:

##########
# Macros #
##########
if=             "em0"          # Realtek = "re0", Intel = "igb0" or "em0" - Whatever your interface is named.
jif=            "lo1"          # We use the clone of lo0 for jail traffic        
loopback=       "lo0"
jnet=           $jif:network

jailhost=       "1.1.1.1"      # I put my public IP here.

#jails
jail1=          "172.17.2.1"       # Describe my jail
jail2=          "172.17.2.2"       # do.
jail3=          "172.17.2.3"       # do.

#aliases for services
tornode=       $jail1
web=           $jail2
mail=          $jail3

The rest is a typical firewall setup.

If I want SSH access (on port 1234) from the outside to a specific jail I will have a NAT rule. This will map to jail1 on port 22.

rdr pass log inet proto tcp from any to ($if) port 1234 -> $jail1 port ssh

So if you have several jails running with SSH on port 22 then you will get the errors you see as the default SSH config binds to 0.0.0.0. If you bind to the specific IP address you will not see the error.

If you look in /etc/ssh/sshd_config in jail1 you will as default have:

#ListenAddress 0.0.0.0

You then simply bind it to the specific IP for the jail:

ListenAddress 172.17.2.1

Back to /etc/pf.conf. If I want the tornode to be able to reach my web jail then I explicit allow access on port 80 and 443.

pass on $jif proto tcp from $tornode to $web port http
pass on $jif proto tcp from $tornode to $web port https

And if you want to test http within the web jail itself then I need to state that as well:

pass on $jif proto tcp from $web to $web port http

Many roads lead to Rome but the above is a sweet an easy setup which works nicely for me.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy