...............................................................................................

Now that we have a jail cell, it's time to check in and decorate it a little.

Final Jail Setup

The jail setup process is not as sophisticated as FreeBSD's installer. To prepare the environment for your jail, you must perform all of the following commands from within the jail.

1. To begin, first create a jailed /etc/rc.conf. Include the following lines:

........................................................................................

vportmap_enable="NO"

wnetwork_interfaces=""

xsshd_enable="YES"

........................................................................................

Since portmap will not run well in a jail, we turn it off (v). Since the jailed system startup will complain if it can't configure the interface, we tell it to ignore its interfaces (w). And, since you'll have difficulty accessing your jail via a command line once the jail starts, it's easiest to enable sshd on the jail and access it via the network (x).

2.FreeBSD requires an /etc/fstab file. Since the jail has no filesystem control, an empty one suffices.

........................................................................................

# touch /etc/fstab

........................................................................................

3.Because sendmail(8) will complain if the aliases database does not exist, we use newaliases(1) to build the proper database for it. (If you won't be running sendmail in the jail, either because you'll be running postfix, as discussed in Chapter 12, or because you just don't want a mail server here, this isn't an issue.)

........................................................................................

# newaliases

........................................................................................

4.Set a root password for the jailed environment. Use one that's different from the host environment—that's part of what a jail is for, after all.

........................................................................................

# passwd

........................................................................................

5.Your users will appreciate a correct time zone in the jail. (At least they can watch the seconds tick by in their prison.)

........................................................................................

# tzsetup

........................................................................................

181

Starting the Jail

From this point on, your jail will resemble a default FreeBSD install in which you can configure nameservice, add packages and users, and so on. Once you exit this shell, though, the virtual machine will stop running and your jail will shut down.

Note I highly recommend using packages to add software to jailed servers; building ports can take up a lot of CPU time.

Your jail is ready to run multi−user, however. To start the jail in its full long−term, multi−user glory, just run the virtual machine's /etc/rc script from within the jail, either by hand or automatically at boot by adding the command to the end of your /usr/local/etc/rc.d/jail.sh script.

To start a jail from the host system, enter this command:

...............................................................................................

# jail /test1 jailhost 192.168.1.223 /bin/sh /etc/rc

...............................................................................................

Note You'll notice several errors on startup. Most of these are sysctls that cannot be accessed in a jailed environment.

At this point, your jail is running. You can ssh in and configure it exactly as you would any other system.

Managing Jails

Jails do complicate process management. If you're logged in to the actual jail server, you can see all the processes in all of your jails. Which processes are the actual ones in your server, and which belong to a jail?

Doing a ps −ax on the host system shows all running processes, even jailed ones. A STAT of J means that the process is running in a jail. If you have few jails, each with a dedicated purpose, you might be able to guess which is the process you want. For example, if you only have one nameserver, and it's jailed, it's a good bet which named process you're after.

While you might want to manage processes from outside the jail, the simplest way to manage a jail is from within. To do so, log into your jail as root and use ps −ax and all the other standard process−management tools to control running programs. If you don't want to log into the jail, you have to resort to more difficult control mechanisms.

Procfs

To investigate individual processes to learn which jail they're part of, use the process filesystem, procfs. (This is perhaps the only time you'll ever need to manually dig around in /proc—it's normally only used by programs such as ps and top.) This procedure is most useful for identifying a jail from a process ID. If you see a database process running amok and soaking up your memory, you can check its PID under /proc to see what jail it's in and act appropriately.

/proc contains a directory for each process running on the system. (If you're bored, you can look

182