Questions tagged [jails]
The jails tag has no usage guidance.
99
questions
0
votes
0
answers
72
views
php artisan commands not working for jailed user
I jailed a user using jail-shell from github (https://github.com/pymumu/jail-shell). The user has php binaries. So the php command works. But when I execute php artisan commands like 'php artisan ...
- 31
0
votes
1
answer
105
views
How to log and block all internet access from a program?
I have a binary from an untrusted source, and I would like to block and log any internet access attempt, and see to what server it tries to connect.
A first way I though of is using firejail https://...
- 129
1
vote
1
answer
188
views
Does fstab make sense for chroot jail?
I've created an fstab file (to mount /dev/pts and /proc, with the bind option) as part of a jail but when I chroot to the jail neither filesystem is mounted. This makes me wonder when the fstab for a ...
- 177
2
votes
1
answer
460
views
Jail/Sandbox process on an overlay root and track changes
What I am trying to achieve
I want to run a process as an unprivileged user, but all files that are changed by this process should be only changed in a shadow folder. Furthermore, I want to disable ...
- 131
1
vote
1
answer
365
views
Run firefox within a Linux chroot jail in FreeBSD 13.1
I have managed to install a Ubuntu chroot jail within FreeBSD 13.1. However, I need to run Firefox from it to launch Jupyter Lab from a python virtual environment within the chroot subsystem. I was ...
- 111
2
votes
0
answers
99
views
How to re-enable the `enable` command?
As part of a script to set up a restricted user, I ran the enable -n enable command. For testing purposes I would like to undo that command but I can't find any documentation on how to do so. I know ...
- 244
2
votes
2
answers
1k
views
Restrict linux process write permission to one folder
I want a process (and all its potential children) to be able to read the filesystem according to my user profile but I want to restrict that process's write permission to only a set of pre-selected ...
- 205
1
vote
0
answers
51
views
Empty executables after creating bind mount
I've created a bind mount in /tmp/test which I then use to establish a chroot jail. For example:
mount --bind -o ro /usr/bin/ /tmp/test
chroot /tmp/test /some_executable
This seems to work fine - most ...
0
votes
1
answer
105
views
Resolve local webserver to public domain
Is there a way to forward traffic on mydomain.com to local web server hosted on virtual machine ( bhyve )?
Let's say my local machine has local IP - 1.1.1.1
And my registered domain in X hosting ...
2
votes
2
answers
1k
views
man returns execve: No such file or directory in chroot jail
I created a chroot jail and copied multiple binaries and their corresponding libraries to the relevant subdirectories. Example:
cp -v /usr/bin/edit /home/jail/usr/bin
ldd /usr/bin/edit
linux-...
- 417
0
votes
1
answer
79
views
What is the `/` command displayed by htop?
I’m running FreeBSD 12.1-RELEASE on my home server.
From time to time, the server’s HDDs thrash for hours on end, even though the server itself should be idle. (I have no cron jobs scheduled, and I ...
- 213
1
vote
0
answers
53
views
Confusion about FreeBSD jail being up to date (or not)
I'm new to FreeBSD system administration and I'm a little confused about keeping jails up to date. Different commands seem to give conflicting information:
After sudo pkg -j 18 upgrade, re-running ...
- 111
1
vote
1
answer
990
views
How do I access my jail by hostname on a home network?
I'm using FreeNAS (FreeBSD), and I've created a jail, and I've given the jail a hostname, and I can access the jail via IP address, but I can't access the jail by it's hostname. (within my home ...
- 111
1
vote
1
answer
120
views
Ezjail network in aws ec2 instance
I am trying to connect a jail to the internet in a aws ec2 instance. I am able to create the jail and execute a console inside, the problem is that the jail does not have any connection to the outside....
0
votes
0
answers
40
views
mv -v , but only when something happens
For maintenance reasons, I have a cron job like mv -vn folderA/* folderB
However every time it is executed I got an email, even if nothing is moved,
can this be set to distinguish between cases?
(...
- 1
0
votes
1
answer
1k
views
Upgrading base jail with iocage fails on FreeBSD/FreeNAS
I have tried to upgrade a few 11.3 base jails to 11.4 on my FreeNAS server running FreeBSD 11.3. I used:
iocage upgrade -r 11.4-RELEASE my-jail-name
Some of the jails were failing with etcupdate ...
- 111
-2
votes
2
answers
292
views
SFTP jail for the root user?
So While I've been looking into ways of locking down users and locking them down into jails. I've came across an interesting question that I haven't seen answered anywhere.
How can one posses the ...
3
votes
1
answer
2k
views
How can I enable/disable a jail using fail2ban?
We can add a line like this below a specific jail in the jail.local file, and control the jail:
enabled = true/false
But I think there should be a command to do this, as we've got bunch of "set&...
4
votes
1
answer
3k
views
Fail2ban multiple actions
I am trying to create a jail for fail2ban, where upon a regex match I want to block the source IP from reaching either port 80 or 443 on my server.
I've tried variations of this:
action = iptables[...
- 1,678
0
votes
1
answer
197
views
Program run though chroot jail gives error about encoding?
I'm new to chroot jails; so far I've setup bash using this tutorial, and I've been able to login with the user through ssh secured with a public key.
The SSH configuration takes care of running the ...
- 4,555
0
votes
1
answer
611
views
ldd and chroot jails when lib64 points to lib?
I'm following this tutorial and on step 2 they look up a bunch of dependency libraries for bash. (I'm assuming you would need to do this for any command that you wish the chroot jail user that is ...
- 4,555
1
vote
1
answer
779
views
how can I manage services running in freebsd jail
I've inherited some systems that run on freebsd and inside jails. Basically the services running are old versions of qmail, spamd, dovecot, etc. None of the versions are up to date or even ...
- 145
0
votes
1
answer
1k
views
Differences between LXC, KVM and Firejail
Also, what is the closest thing to FreeBSD jails in GNU/Linux?
- 391
3
votes
1
answer
878
views
First time installing TinyDNS as a service in a FreeBSD jail - how to do it?
I'm using FreeBSD 11.2 at the moment (likely to move to 12 in a while). I need a tiny authoritative-only DNS server (no lookup or caching needed, under 10 domains and under 10 queries/hr, almost no ...
- 1,221
3
votes
1
answer
1k
views
Why does `chroot` operation result in error: "bash: /root/.bashrc: Permission denied"?
Why does chroot operation result in error: "bash: /root/.bashrc: Permission denied"?
I've been testing chroot for learning purposes, and have encountered the following error, when executing /bin/bash:...
- 4,203
1
vote
0
answers
830
views
Restricted shell within docker container
Some context for my question: I am working on a pty NodeJS server running in docker where I want to provide users connecting to the shell an isolated environment where they can play around with ...
- 111
1
vote
1
answer
115
views
Multi-jail /var separation
I'm setting up multiple jails in FreeBSD to serve dynamic websites. The host environment has a webserver that dispatches connection based on HTTP Host header, and each jail has a /var/lib/www-db ...
- 622
0
votes
0
answers
87
views
Securing an open FTP on FreeBSD for visitor wifi speed testing?
I'd like to add a really simple local FTP server to my FreeBSD system, to allow guests to do wifi speed testing.
Because of the use, I don't need more than very basic functionality - anon R/W to a ...
- 1,221
1
vote
0
answers
55
views
Can I limit a process's access to specified files and stdout only without root?
I want to setup a server for students to upload C code. The server compiles C code, run the binary and shows output to students.
Now I am having security concern. Students can upload any code, but I ...
- 449
1
vote
2
answers
574
views
What is the reason FreeBSD jails don't get the entropy pool
I've noticed that the FreeBSD script that
generates entropy,
bails out if it finds it
itself is running from within a jail.
# uname -srm ## notice: install of mfsBSD (https://mfsbsd.vx.sk)
FreeBSD ...
- 139
0
votes
1
answer
310
views
Running Tor service in the jail environment
I want to torify my FreeBSD old machine purposed to mainly darknet activities. Questions:
Should I worry about these errors during creating jail?
Warning: Some services already seem to be listening ...
user227030
2
votes
1
answer
2k
views
How to use Jailkit Jail Manager in Virtualmin to restrict users
How to use Jailkit Jail Manager in Virtualmin (Webmin 1.892) to restrict users in their homes including virtual website and all services running under user?
I am setting up small website hosting ...
- 303
2
votes
1
answer
2k
views
Is a Chroot Jail for SSH *and* SFTP?
I'm trying to setup a chroot jail, but I'm not sure how to make this work in SSH and SFTP. A quick question, will something like this work for both SSH and SFTP or just SSH? If it doesn't work for ...
- 191
2
votes
1
answer
89
views
Can the contents of a FreeBSD jail be installed as the main OS?
Is it conceptually possible to take a FreeBSD jail and copy the contents to my root filesystem and expect it to boot up?
Note that because the jail doesn't have a kernel, I will have to copy that ...
- 1,214
1
vote
2
answers
3k
views
chroot an user to more than one directory in different locations
I would like to know how I can constraint a user to only be able to access and have RWX permissions to directories like /etc/httpd, /etc/php and /var/www/html as well as its own home directory.
Also ...
- 3,101
0
votes
1
answer
798
views
Proper way to jail user so shell doesn't immediately close
Trying to use jailkit on Centos7. I've installed by source and also used RPM's at http://dries.eu/rpms/jailkit/jailkit, and get the same results. I am primarily following https://olivier.sessink.nl/...
- 1,887
0
votes
1
answer
297
views
Why will shell automatically close for jailed user with 777 home?
Jailed a user using https://olivier.sessink.nl/jailkit/ on Centos7
sudo jk_jailuser -m -j /home/jail -v -s /bin/bash testing
sudo jk_cp -v -f /home/jail /bin/bash
Then made /home/jail/home/testing ...
- 1,887
3
votes
1
answer
4k
views
How to change the default (binary) python version in a FreeBSD jail?
In a jail, I have installed python3.6 along python3.4. Both were installed using pkg install, no ports. I want to keep the 3.4 version for some time, but set the 3.6 as default.
Answers found in ...
- 141
1
vote
1
answer
209
views
Create a second Jail on FreeBSD?
I recently created a Jail on FreeBSD 11 Release, I used the steps listed on the ezjail section of the handbook The handbook, specifically:
echo cloned_interfaces="lo1" >> /etc/rc.conf
service ...
- 31
1
vote
0
answers
91
views
Problem in Bind with 4 views
I have Bind server installed on FreeBSD Jails. I have master and two slaves. And I have 4 views for different locations. When I add some record on master zone and type rndc reload I see that all 4 ...
- 359
4
votes
1
answer
749
views
How can I run a program with limited permissions
I noticed that a lot of my programs run under the same user like (firefox,chromium,steam,etc...) and therefore should have the same permissions as this user, but I would prefer to limit their accesses....
- 339
0
votes
1
answer
1k
views
How to run firejail as root?
How can I run firejail as a root user?
# firejail --seccomp firefox
Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/...
- 2,993
5
votes
1
answer
5k
views
ssh in chrooted jail doesn't work because of /dev/null operation not supported
I am trying to set up a ssh-chroot jail on one of my NAS servers. The system runs on NAS4Free (which is based on nanobsd). The user should be able to run only one command, which is a bash-script that ...
- 340
1
vote
0
answers
129
views
Problem with MySQL timezone
I have installed MySQL,version 5.6.16.My OS is FreeBSD,version is 9.3.MySQL installed on jail.When I check date I see Thu Nov 17 15:22:14 AMT 2016,I see this output also on the system.In MySQL,when I ...
- 359
2
votes
1
answer
1k
views
Complete isolation in Linux sandboxing
Applications on iOS (and perhaps the ones that are sandboxed on OS X) are confined to a virtual root filesystem that only has the files and directories specific to the application. The root seen by an ...
- 3,888
3
votes
1
answer
1k
views
Freebsd: pf firewall doesn't work on restart
I'm running FreeBSD 10.3 p4 and observed some strange behavior
When restarting the machine pf starts due to /etc/rc.conf entry
# JAILS
cloned_interfaces="${cloned_interfaces} lo1"
gateway_enable="...
- 133
1
vote
1
answer
433
views
Globally writable files and user-based process jailing
I want to be able to generically pick a certain executable (potentially malicious) x and run it (from an admin account) with write access restricted to certain directories (dynamically deduced) "${...
- 28.5k
5
votes
2
answers
2k
views
Accessing ports on public IP from within a FreeBSD jail
In a FreeBSD 10 setup, I have a jail running the publicly accessible nginx web server and another jail for the Java backend server based on Jetty. Each jail has its own internal IP address 127.0.1.x ...
4
votes
1
answer
2k
views
How to change Squid service UID in FreeBSD?
Strangely enough, it appears that Squid cannot start if the squid user is not affected to the UID 100. When trying to use another PID, the service systematically fails to start with the following ...
- 2,841
2
votes
1
answer
361
views
FreeBSD - UFS equivalent of ZFS command
I'm trying to configure jails with this tutorial.
Since I don't want to use ZFS, could anyone tell me the UFS equivalent of
zfs create -o mountpoint=/local/jails zpool/jails
chmod 700 /local/jails &...
- 237