On 8/10/2010 5:02 PM, Fbsd8 wrote:
1. ping is a security risk from within a jail and is disabled by
design. (read jail(8) for details). No use using a jail if the first
thing you do is re-enable ping in the jail. To test for public
internet connection from within a jail use dig or whois commands.
There is a vast difference between testing a network connection and
leaving something in for live deployment. Tools like ping and traceroute
are for network diagnostics. You can easily run into a situation where
dig and whois don't work but ping/traceroute will in which case you
quickly realize hostnames aren't resolving in a jail (or you can find
out where exactly packets stopped at). Meanwhile the person using only
dig and whois might be spinning their wheels trying to fix problems that
aren't really problems. They might of created a jail and have everything
setup except they forgot to create an /etc/resolv.conf in the jail.
There is nothing wrong with allowing raw sockets to get up and running
and then changing it back (the jail man page states to use caution with
raw sockets not a blatant don't do it).
2. Using the hosts firewall to drive traffic to a jail is a sign you
have your jail incorrectly configured or do not understand how jails
are intended to work.
If you have jails assigned to non routable ip's (i.e. 10.0.0.2,
10.0.0.3) how else would you redirect traffic coming in from your hosts
ip:(http_port, dns_port, etc..) to the corresponding jail that handles
it. I've read a bunch of stuff on jails and unless I missed something
(which is totally possible) using a NAT that's part of a firewall seems
like pretty standard fare. How else would you go about it?
3. Jail do not have a network stack of their own, so they cant have a
firewall. The host's firewall and and network stack are in control.
The documentation is rather sparse since it's so new and I personally
haven't used it but FreeBSD 8 has VIMAGE (network stack virtualization).
http://wiki.freebsd.org/Image/VNETSamples
http://bsdbased.com/2009/12/06/freebsd-8-vimage-epair-howto
http://wiki.polymorf.fr/index.php/Howto:FreeBSD_jail_vnet
4. There are 2 utilities for creating jails. Qjail the better
documented of the 2, is designed for the novice which clearly you are.
I strongly suggest you checkout
http://sourceforge.net/projects/qjail
You should probably preface this by saying you're the author of Qjail
and have been actively promoting it in a few places including the fbsd
forums. Nothing wrong with that I guess, but I still haven't been able
to figure out how it's any different(better?) than ezjail(which has both
an excellent website and man page).
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
