rendered paste bodyVIMAGE JAIL SOLUTION on laptop
System
------
Lenovo Thinkpad X200
host# uname -a
FreeBSD host.domain.tld 8.2-RELEASE FreeBSD 8.2-RELEASE #1: Wed Sep 28 15:30:38 CEST 2011
administrator@host.domain.tld:/usr/obj/usr/src/sys/VIMAGE2KERNEL amd64
Network
......................................................................
ethernet cable connection to an orange livebox router
wireless radio button is off
......................................................................
1. compile a custom kernel with VIMAGE + NULLFS support
-------------------------------------------------------
host# cat /usr/src/sys/amd64/conf/VIMAGE2KERNEL
include GENERIC
cpu HAMMER
ident VIMAGE2KERNEL
# Virtual networking for jail
nooptions SCTP
options VIMAGE
# The nullFS to mount local directory
options NULLFS
host# cd /usr/src
host# make buildkernel KERNCONF=VIMAGE2KERNEL
host# make installkernel KERNCONF=VIMAGE2KERNEL
2. add netgrap kernel modules to boot loader
--------------------------------------------
host# cat /boot/loader.conf
ng_bridge_load="YES"
ng_eiface_load="YES"
ng_ether_load="YES"
ng_socket_load="YES"
host# reboot
3. download & add /etc/rc.d/vimage
----------------------------------
host# ls -la /etc/rc.d/vimage
-rwxr-xr-x 1 root wheel 16437 Sep 28 17:21 /etc/rc.d/vimage
4. make an initial base jail and duplicate it to an example jail
----------------------------------------------------------------
host# cd /usr/src
host# mkdir -p /usr/jail/base
host# make buildworld installworld distribution DESTDIR=/usr/jail/base
host# cd /usr/jail
host# cp -Rp base example
host# echo 'hostname="example.domain.tld"' >> /usr/jail/example/etc/rc.conf
host# mkdir /usr/jail/example/usr/ports
host# mkdir -p /etc/jails/fstabs
host# ee /etc/jails/fstabs/example
/usr/src /jails/example/usr/src nullfs ro 0 0
/usr/ports /jails/example/usr/ports nullfs ro 0 0
5. add vimage & jail settings to /etc/rc.conf
---------------------------------------------
host# cat /etc/rc.conf
hostname="host.domain.tld"
network_interfaces="em0 iwn0"
ifconfig_em0="DHCP"
wlans_iwn0="wlan0"
ifconfig_wlan0="DHCP"
sshd_enable="YES"
keymap="danish.cp865"
dbus_enable="YES"
gnome_enable="YES"
gateway_enable="YES"
ipv6_gateway_enable="YES"
vimage_enable="YES"
vimage_parallel_start="NO"
vimage_list="example"
vimage_set_hostname_allow="YES"
vimage_socket_unixiproute_only="NO"
vimage_sysvipc_allow="YES"
vimage_example_rootdir="/usr/jail/example"
vimage_example_hostname="example.domain.tld"
vimage_example_bridges="em0 wlan0"
vimage_example_vnets=""
vimage_example_exec_start="/bin/sh /etc/rc"
vimage_example_services="sshd"
vimage_example_exec_afterstart0=""
vimage_example_exec_stop="/bin/sh /etc/rc.shutdown"
vimage_example_devfs="YES"
vimage_example_devfs_ruleset="devfsrules_jail"
vimage_example_fdescfs_enable="YES"
vimage_example_procfs_enable="YES"
vimage_example_mount_enable="YES"
vimage_example_fstab="/etc/jails/fstabs/example"
vimage_example_flags="-l -U root"
6. start vimage example jail
----------------------------
host# /etc/rc.d/vimage start
Configuring vimages:.
Starting vimages:mount: /usr/jail/example/dev/fd: No such file or directory
example.domain.tld.
7. login to example jail & setup basics
---------------------------------------
host# jexec example login -f root
example# ee /etc/rc.conf
hostname="example.domain.tld"
network_interfaces="ng0_example"
ifconfig_ng0_example="inet 192.168.1.100/24"
sshd_enable="YES"
example# ee /etc/resolv.conf
search home
nameserver 192.168.1.1
nameserver 192.168.1.1
example# exit
8. restart example jail
-----------------------
host# /etc/rc.d/vimage restart
Stopping vimages: example.spiritofsophia.eu.
Configuring vimages:.
Starting vimages:mount: /usr/jail/example/dev/fd: No such file or directory
example.domain.tld.
9. test example jail
--------------------
host# jexec example login -f root
example# ping -c 1 192.168.1.38
PING 192.168.1.38 (192.168.1.38): 56 data bytes
64 bytes from 192.168.1.38: icmp_seq=0 ttl=64 time=0.038 ms
example# ping -c 1 192.168.1.1
PING 192.168.1.1 (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: icmp_seq=0 ttl=64 time=1.578 ms
example# traceroute 192.168.1.38
traceroute to 192.168.1.38 (192.168.1.38), 64 hops max, 52 byte packets
1 host.home (192.168.1.38) 0.058 ms 0.026 ms 0.021 ms
example# traceroute 192.168.1.1
traceroute to 192.168.1.1 (192.168.1.1), 64 hops max, 52 byte packets
1 router.home (192.168.1.1) 1.289 ms 1.283 ms 1.232 ms
example# ping freebsd.org
PING freebsd.org (69.147.83.40): 56 data bytes
ping: sendto: No route to host
example# traceroute freebsd.org
traceroute: findsaddr: failed to connect to peer for src addr selection.
example# ssh 192.168.1.38
PRNG is not seeded
host# ssh 192.168.1.100
ssh: connect to host 192.168.1.100 port 22: Connection refused
host# ping -c 1 192.168.1.100
PING 192.168.1.100 (192.168.1.100): 56 data bytes
64 bytes from 192.168.1.100: icmp_seq=0 ttl=64 time=0.044 ms
host# traceroute 192.168.1.100
traceroute to 192.168.1.100 (192.168.1.100), 64 hops max, 52 byte packets
1 PC5.home (192.168.1.100) 0.055 ms 0.030 ms 0.022 ms