Noob Jail question.

[Da Rock]

On 12/16/10 09:32, Dave wrote:
> Hi.
>
> As some of you may remember, I've managed to build a F'BSD V8.0 based
> system that provides me with:-
>
> Local GPS disiplined NTP server (working very well) the reason I built
> the thing in the first place, but it seems FreeBSD can do so much more,
> so I also have.....
>
> Hiawatha webserver (also working well)
>
> FTPD for updating the web pages Hiawatha serves up (working well)  Other
> systems here generate data, that is FTP'd over the LAN to the web page
> folders.
>
> SSH remote login for admin needs (But not for "root" login) Also working
> well.
>
> All this will start happily, boot and sort itself out as a "headless"
> machine, and if needed collapse gracefully and shutdown cleanly, with one
> press of the power button.  I am impressed!
>
> I've been reading the FreeBSD Manual (a dangerous thing to do during
> lunchtimes!) relating to Jails.  Other than making my head spin, I'm
> finding it a tad dificult finding out just what you can/cant do with a
> Jail.  Mainly, because I'm not familiar with a lot of the terms used, and
> though the man pages are no doubt correct as a reference, they don't
> "explain" it well, in as much as how to use it, well in my addled mind at
> the moment.
>
> I think I'd like to run Hiawatha in a Jail, as it seems "the right thing
> to do" with something that will be exposed to the www.
> (Comments/advice?)
>
> But, how do I arrange it to safely get (read only) access to the website
> data, without preventing the FTPD service from having access to update
> that data.  FTPD will only be reachable from LAN side of the main gateway
> router, Hiawatha will have an outside world port forwarded to it by the
> router.
>
> What I'm asking I guess, is..  Can a jail'd app, reach outside the jail
> in "read only" mode.   (I suspect, maybe?)   Or can an app outside the
> jail, drop stuff off inside the jail?  (For whatever reason, I suspect
> not?)
>
> If anyone understands what the heck I'm blathering on about, please
> explain it to me, as I think I've lost the plot.
>
> Comments, advice, brickbats etc?
>
> Best Regards.
>
> Dave B.
>    
Sounds good. A jail is essentially paravirtualisation, in other words it 
partitions your OS into distinct segments. Linux has just started making 
inroads on this with vserver and such.

The kernel stays the same, but you actually have separately distinct 
kernel code, security, etc for each jail. So it make sense then to run 
just one service within it, but its possible to run an entire system- 
with multiple systems on one host. This method is extremely fast, barely 
any trade off compared to running say VirtualBox, VMWare, or Qemu.

As you read, you hand off a branch in your file system to hold the data 
for the jail (kernel, world, and apps and associated data etc), and the 
jail system inside the jail can only see that branch. Thats its 
equivalent of / on the host. It can't see outside of that unless you 
place something inside that banch from the host. You even have to 
actually mount a separate devfs inside the jail if required.

So you want FTPD to drop files into the webserver, and the webserver is 
in a jail; then (consider the security of what your attempting) either 
FTPD has to access the branch containing the jail and webroot, or mount 
using nullfs the branch containing FTPD directory inside the jail.

HTH and good luck. For bonus points you can even try a service only 
jail, where you don't need the whole system in the jail, just the 
libraries needed by the service app :)