FreeBSD: Foundation Announces Jail Based Virtualization

We are pleased to announce that Bjoern A. Zeeb has been awarded a grant to improve FreeBSD's jail based virtualization infrastructure and to continue to work on the virtual network stack. His employer, CK Software GmbH is matching the Foundation's funding with hours.

FreeBSD has been well known for its jail based virtualization during the last decade. With the import of the virtual network stack, FreeBSD's operating system level virtualization has reached a new level.

This project includes cleanup of two years of import work and development and, more notably, brings the infrastructure for a network stack teardown. Cleanly shutting down a network stack in FreeBSD will be the major challenge in the virtualization area to get the new feature to production ready quality for the 9.x release
lifecycle.

Further, the project includes generalization of the virtual network stack framework, factoring out common code. This will provide an infrastructure and will ease virtualization of further subsystems like SYSV/Posix IPC with minimal overhead. All further virtualized subsystems will immediately benefit from shared debugging facilities, an essential feature for early adopters of the new technology.

(more..)

Securing Network Services with FreeBSD Jails

In this article by Christer Edwards, we will explore FreeBSD Jails. FreeBSD Jails are a kernel-level security mechanism which allows you to safely segregate processes within a sandbox environment. Jails are commonly used to secure production network services like DNS or Email by restricting what a process can access. In the case of a malicious attack on one service, all other Jailed processes would remain secure. FreeBSD Jails securely limits, in an administratively simple way, the amount of damage an attacker can do to a server.

Creating A Jail With VNC Server On FreeBSD

This article explains how you can run a VNC server from within a jail on FreeBSD.

The night of 1000 jails

As FreeBSD 8.0 is right around the corner it's the right time to get it some more exposure. Just for kicks I got the idea to stress the Jails subsystem - the cheap (both in $$$ and resource requirements) OS-level virtualization technology present in FreeBSD for nearly 10 years now. Behold... the bootup of 1,000, count them - 1,000 virtual machines on a single host with 4 GB of RAM.

How To Upgrade FreeBSD Jail ( OS Level Virtualization )

I've FreeBSD jail configured as explained in man pages using make world options. Now I've upgrade my base FreeBSD 7.0 system to FreeBSD 7 patch level 4. How do I upgrade my Jail (FreeBSD VPS) so that everything get updated inside jail?

ezjail - A jail administration framework

I want to set up some jails. They will each be very similar. They will each be used to test a slightly different configuration of Bacula. My tool of choice is ezjail, available in the ports tree.

With ezjail, I can:

* create a jail flavour, upon which the creation of other jails can be based
* centrally update the jail's ports tree

The above does not fully describe the neat things you can do with ezjail. Read below to discover more fun and interesting things.

(more...)

Managing Jails

This document is an introduction to basic FreeBSD jails also called ‘fat jails’. We discuss an easy jail installation process. We will do some basic jail configuration and show you how to manage the jail environment. This document wil not cover building ‘chroot jails’ in a jail.

Creating and Managing A Jailed Virtual Host in FreeBSD

This Howto article is intended to be a practical example, and I will start my host system with FreeBSD 6.2-RELEASE. The Install will be of the "minimal" variety, and for the first part of this document, we will not update the system with buildworld. After a jail is created, we will then update the host, and then update the jail. This will demonstrate a practical example of how to build, and then maintain a jail thru critical security releases.

Creating multiple jails

Jails are useful tool for achieving a certain level of virtualization. I have used jails in the past for creating sandboxes for testing of the Bacula project. Today, I will be setting up 7 jails, each for regression tests on different configurations. In the process, I'll show you some shortcuts that Ryan Lortie (desrt) told me about. It saves time. I'll also share some scripts that will help with the setup of various jail items.

This article should be read in conjunction with my other jail articles. It won't stand alone unless you are already familiar with jails and how to configure them.

sysjail redivivus: emulation, cleanliness, and completion

sysjail, sysjail.bsd.lv, is a user-land virtualisation system first released early last year. The primary goal of sysjail is to provide the functionality of FreeBSD's jail(8) to OpenBSD (and NetBSD) users.

(more...)

OS Virtualization on FreeBSD vs. Linux

I was talking to somebody at OSCON last week and they made an off-hand comment about using FreeBSD jail to isolate software applications in a development environment.

Being a linux guy, it took a while to sink in that jail was a form of operating system virtualization.

(more...)

Put your OpenSSH server in SSHjail

Jailing is a mechanism to virtually change a system's root directory. By employing this method, administrators can isolate services so that they cannot access the real filesystem structure. You should run unsecured and sensitive network services in a chroot jail, because if a hacker can break into a vulnerable service he could exploit your whole system. If a service is jailed, the intruder will be able to see only what you want him to see -- that is, nothing useful. Some of the most frequent targets of attack, which therefore should be jailed, are BIND, Apache, FTP, and SSH. SSHjail is a patch for the OpenSSH daemon. It modifies two OpenSSH files (session.c and version.h) and allows you to jail your SSH service without any need for SSH reconfiguration.

(more...)

How to Use Jail Tools

A few hints and tips using jail and JailTools (aka jail_tools)

Jaulas bajo FreeBSD 6

Muy buen artículo que muestra el proceso de creación de jaulas en FreeBSD 6. En el mismo artículo salen los enlaces para crear jaulas sobre FreeBSD 4 y 5.