Re: Best practices about Jails

2012-04-20 Thread Andrea Venturoli
On 04/04/12 16:06, Fbsd8 wrote: This is overkill. I single ports tree on the host is fine. Matter of fact I use packages for everything accept for php which I have to compile in apache module. I even pre-install all of php's dependents as packages before doing make install on the php port. As

Best practices about Jails

2012-04-04 Thread Andrea Venturoli
Hello. Plase forgive the long post and the amount of questions, but I'm new to jails and I'd like to be sure of what I'm doing before deploying more than a test one. Right now I need to run a commercial Java app, which, ideally, I would forbid to access files outside its directory. This might

Re: Best practices about Jails

2012-04-04 Thread Fbsd8
Andrea Venturoli wrote: Hello. Plase forgive the long post and the amount of questions, but I'm new to jails and I'd like to be sure of what I'm doing before deploying more than a test one. Right now I need to run a commercial Java app, which, ideally, I would forbid to access files outside

Re: Best practices about Jails

2012-04-04 Thread Mark Felder
On Wed, 04 Apr 2012 09:06:25 -0500, fb...@a1poweruser.com wrote: Firewall in a jail will not work. Only the host firewall has access to the network. Jailsv2 allows your own firewall in the jail. You get a full network stack. This is not supported by ezjails, and should still be marked

Re: Best practices about Jails

2012-04-04 Thread Roland Smith
On Wed, Apr 04, 2012 at 10:16:37AM +0200, Andrea Venturoli wrote: Hello. Plase forgive the long post and the amount of questions, but I'm new to jails and I'd like to be sure of what I'm doing before deploying more than a test one. Right now I need to run a commercial Java app, which,

Re: Best practices about Jails

2012-04-04 Thread Adam Vande More
On Wed, Apr 4, 2012 at 3:16 AM, Andrea Venturoli m...@netfence.it wrote: Second question: from inside the jail I can access all services on localhost (eg. telnet localhost pop3, where a pop3 server is running on the host). Can this be avoided, e.g. with ipfw? Ideally, since this jail will run