Skip to main content
7 votes
Accepted

ssh in chrooted jail doesn't work because of /dev/null operation not supported

I created dev/null using mknod dev/null c 2 2 Your knowledge is outdated. Things do not work this way any more, now that NAS4Free is based on the likes of FreeBSD 10 and 11. (Nor are those the ...
JdeBP's user avatar
  • 69.5k
6 votes
Accepted

First time installing TinyDNS as a service in a FreeBSD jail - how to do it?

This is rather lenghty so the very short version for those who cannot be bothered to read it all: echo "testjail { }" >> /etc/jail.conf mkdir -p /usr/local/jails/testjail bsdinstall jail /usr/...
Claus Andersen's user avatar
5 votes
Accepted

Freebsd: pf firewall doesn't work on restart

The problem here is that /etc/rc.d/pf runs before /usr/local/etc/rc.d/ezjail, so the kernel hasn't configured the jailed network by the time it tries to load the firewall rules. You might be tempted ...
D_Bye's user avatar
  • 14k
5 votes

Fail2ban multiple actions

You can't use the same action name twice in the same jail. Here it's "iptables". Note that name= is the parameter name which is action oriented (action runtime parameter, in case of iptables ...
Hardoman's user avatar
  • 151
5 votes
Accepted

man returns execve: No such file or directory in chroot jail

You should type the command strace -f man ls 2>ls.log and see how many execve lines there are in the ls.log file. You will have /usr/bin/pager, nroff, groff, tbl… groff would surely need a lot of ...
Frédéric Loyer's user avatar
3 votes

Restrict linux process write permission to one folder

You might be able to use systemd. It has a number of settings that control file system access like ReadOnlyPaths and ReadWritePaths. Here is a quick example of running a command using systemd-run ...
Andrew Lowther's user avatar
3 votes
Accepted

Automate deploying a bunch of thin jails

The automation tool would be simple shell scripts or if you are already using Bastille you would create an equally simple template. You can either do your actions from "outside" the jail by ...
Claus Andersen's user avatar
2 votes

How to remove a (plugin) jail from FreeNAS

From the 9.30 GUI, go to Plugins, then click the installed tab (the default tab is All), then select and hit delete on the jail that you need to remove.
JP_in_VA's user avatar
2 votes
Accepted

Globally writable files and user-based process jailing

First sorry for my bad english. Lets show something for you using only unix concepts, cause i think it can help (or maybe not). Imagine that i want that the executable nano can be executed by every ...
Luciano Andress Martini's user avatar
2 votes

Create a second Jail on FreeBSD?

Figured out by myself, instead of: echo cloned_interfaces="lo1" >> /etc/rc.conf I needed to use: echo cloned_interfaces="lo1 lo2" >> /etc/rc.conf
Zkimal's user avatar
  • 31
2 votes

How can I run a program with limited permissions

Use setfacl: setfacl -m u:backup-process-username:rwx backup-folder This is an answer to a similar question: https://askubuntu.com/a/809562/707299
Timothy Swan's user avatar
2 votes
Accepted

chroot an user to more than one directory in different locations

A jailed user won't be able to access those folders as-is. If you have acl enabled on the filesystem, you could create a regular user and control access to the directories by using an access control ...
L.Ray's user avatar
  • 479
2 votes
Accepted

Why does `chroot` operation result in error: "bash: /root/.bashrc: Permission denied"?

Passing --userspec to chroot is not the same thing as running su - user inside the chroot environment; i.e. the home directory is still that of root i.e. /root which is why bash is trying to read /...
wurtel's user avatar
  • 16.2k
2 votes

Upgrading base jail with iocage fails on FreeBSD/FreeNAS

It turns out the reason the /usr/local/sbin/etcupdate script was failing was because it was protecting some files from being deleted by setting a chflags schg system immutable flag, see line 213 of ...
Rafal Lukawiecki's user avatar
2 votes

Jail/Sandbox process on an overlay root and track changes

I found a solution combining multiple of the above-mentioned commands. mkdir -p /tmp/overlay-test/{upper,workdir,mount} unshare -- map-root-user --net --mount or short unshare -rnm mount.mergerfs / /...
Raphael Jenni's user avatar
1 vote

Run firefox within a Linux chroot jail in FreeBSD 13.1

Change your DISPLAY value to be ip:0.0 where ip is the ip address of the FreeBSD system running the X server. The use of unix:0.0 is local to the jail and it’s not a good idea to run the X server in ...
James Risner's user avatar
  • 1,302
1 vote

How can I enable/disable a jail using fail2ban?

The proper way is to create a file /etc/fail2ban/jail.d/service.local or edit /etc/fail2ban/jail.local: [service] enabled = true Don't forget to restart fail2ban: systemctl restart fail2ban.service ...
Gilles Quénot's user avatar
1 vote

Program run though chroot jail gives error about encoding?

Instead of chroot, use a container, such as docker (there are many others): It does more: chroot, namespace isolation, cgroups, etc. It manages it for you. For docker there are pre-built images. ...
ctrl-alt-delor's user avatar
1 vote

Differences between LXC, KVM and Firejail

Here's a very brief attempt to summarise the differences between the three tools you mentioned, KVM, LXC, and Firejail. It glosses over a lot of detail, and is not intended to be scrupulously ...
cas's user avatar
  • 79.2k
1 vote

Multi-jail /var separation

There is a simple solution that allows jail to modify its root (which includes /var and /tmp which are both important) while keeping the "template" intact in FreeBSD. Procedures: Create ...
DannyNiu's user avatar
  • 620
1 vote

What is the reason FreeBSD jails don't get the entropy pool

The random(4) device is per-kernel, not per-jail, so it's not useful for those processes to be running in jails at all. https://mailing.freebsd.hackers.narkive.com/iq0HeCDX/save-entropy-in-jail-...
Luciano Andress Martini's user avatar
1 vote

What is the reason FreeBSD jails don't get the entropy pool

tl;dr The entropy pool is only used during bootstrapping. You only have one kernel which supplies the random numbers. By only having one entropy pool you ensure a higher degree of non-determistic ...
Claus Andersen's user avatar
1 vote
Accepted

Is a Chroot Jail for SSH *and* SFTP?

If SSH does a chroot, then it will be effective for all processes started by SSH.
RalfFriedl's user avatar
  • 9,051
1 vote
Accepted

Why will shell automatically close for jailed user with 777 home?

For security reasons ssh and jailkit do not allow writable root directory / and abort if they detect bad permissions. For example if root is writable users could provide their own configuration files ...
sebasth's user avatar
  • 15.1k
1 vote

Accessing ports on public IP from within a FreeBSD jail

I know it's been a while since this was asked, but here goes: What you're describing in the OP is known as "Hairpin NAT." Instead of adding needless load on your gateway however, what you want to do ...
msc's user avatar
  • 11
1 vote

Accessing ports on public IP from within a FreeBSD jail

To answer my own question, I got it to work using the following firewall configuration: # Allow dynaserv jail to access git on https port of web jail pass in on lo1 proto tcp from $ip_jetty to $...
Martin Dirichs's user avatar
1 vote

How to install PostgreSQL 9.3 in FreeBSD jail?

If you want to build ports in a jail that might have read-only filesystems, you better set up your ports environment properly. I use make.conf for this. I use these settings, if my /usr/ports is ...
Martin Sugioarto's user avatar
1 vote

Can LXC be used to jail instances of an installed browser?

An lxc container does not have a display/audio of its own, so it must somehow use the host display/audio. A typical linux solution would be either of share host X resources directly across the ...
Craig  Hicks's user avatar
1 vote

How to achieve the effect of chroot in userspace in Linux (without being root)?

You could try User-Mode Linux. The code for building such a kernel is now present in the mainstream sources, and you can find (outdated) precompiled builds on the page I linked.
Billy's user avatar
  • 685
1 vote

How to "jail" a process without being root?

Firejail is nice tool to jail any process, with or without root access with a lot of options and very flexible: https://firejail.wordpress.com
Anyone_ph's user avatar
  • 111

Only top scored, non community-wiki answers of a minimum length are eligible