VIMAGE JAIL SOLUTION on laptop System ------ Lenovo Thinkpad X200 host# uname -a FreeBSD host.domain.tld 8.2-RELEASE FreeBSD 8.2-RELEASE #1: Wed Sep 28 15:30:38 CEST 2011 administrator@host.domain.tld:/usr/obj/usr/src/sys/VIMAGE2KERNEL amd64 Network ...................................................................... ethernet cable connection to an orange livebox router wireless radio button is off ...................................................................... 1. compile a custom kernel with VIMAGE + NULLFS support ------------------------------------------------------- host# cat /usr/src/sys/amd64/conf/VIMAGE2KERNEL include GENERIC cpu HAMMER ident VIMAGE2KERNEL # Virtual networking for jail nooptions SCTP options VIMAGE # The nullFS to mount local directory options NULLFS host# cd /usr/src host# make buildkernel KERNCONF=VIMAGE2KERNEL host# make installkernel KERNCONF=VIMAGE2KERNEL 2. add netgrap kernel modules to boot loader -------------------------------------------- host# cat /boot/loader.conf ng_bridge_load="YES" ng_eiface_load="YES" ng_ether_load="YES" ng_socket_load="YES" host# reboot 3. download & add /etc/rc.d/vimage ---------------------------------- host# ls -la /etc/rc.d/vimage -rwxr-xr-x 1 root wheel 16437 Sep 28 17:21 /etc/rc.d/vimage 4. make an initial base jail and duplicate it to an example jail ---------------------------------------------------------------- host# cd /usr/src host# mkdir -p /usr/jail/base host# make buildworld installworld distribution DESTDIR=/usr/jail/base host# cd /usr/jail host# cp -Rp base example host# echo 'hostname="example.domain.tld"' >> /usr/jail/example/etc/rc.conf host# mkdir /usr/jail/example/usr/ports host# mkdir -p /etc/jails/fstabs host# ee /etc/jails/fstabs/example /usr/src /jails/example/usr/src nullfs ro 0 0 /usr/ports /jails/example/usr/ports nullfs ro 0 0 5. add vimage & jail settings to /etc/rc.conf --------------------------------------------- host# cat /etc/rc.conf hostname="host.domain.tld" network_interfaces="em0 iwn0" ifconfig_em0="DHCP" wlans_iwn0="wlan0" ifconfig_wlan0="DHCP" sshd_enable="YES" keymap="danish.cp865" dbus_enable="YES" gnome_enable="YES" gateway_enable="YES" ipv6_gateway_enable="YES" vimage_enable="YES" vimage_parallel_start="NO" vimage_list="example" vimage_set_hostname_allow="YES" vimage_socket_unixiproute_only="NO" vimage_sysvipc_allow="YES" vimage_example_rootdir="/usr/jail/example" vimage_example_hostname="example.domain.tld" vimage_example_bridges="em0 wlan0" vimage_example_vnets="" vimage_example_exec_start="/bin/sh /etc/rc" vimage_example_services="sshd" vimage_example_exec_afterstart0="" vimage_example_exec_stop="/bin/sh /etc/rc.shutdown" vimage_example_devfs="YES" vimage_example_devfs_ruleset="devfsrules_jail" vimage_example_fdescfs_enable="YES" vimage_example_procfs_enable="YES" vimage_example_mount_enable="YES" vimage_example_fstab="/etc/jails/fstabs/example" vimage_example_flags="-l -U root" 6. start vimage example jail ---------------------------- host# /etc/rc.d/vimage start Configuring vimages:. Starting vimages:mount: /usr/jail/example/dev/fd: No such file or directory example.domain.tld. 7. login to example jail & setup basics --------------------------------------- host# jexec example login -f root example# ee /etc/rc.conf hostname="example.domain.tld" network_interfaces="ng0_example" ifconfig_ng0_example="inet 192.168.1.100/24" sshd_enable="YES" example# ee /etc/resolv.conf search home nameserver 192.168.1.1 nameserver 192.168.1.1 example# exit 8. restart example jail ----------------------- host# /etc/rc.d/vimage restart Stopping vimages: example.spiritofsophia.eu. Configuring vimages:. Starting vimages:mount: /usr/jail/example/dev/fd: No such file or directory example.domain.tld. 9. test example jail -------------------- host# jexec example login -f root example# ping -c 1 192.168.1.38 PING 192.168.1.38 (192.168.1.38): 56 data bytes 64 bytes from 192.168.1.38: icmp_seq=0 ttl=64 time=0.038 ms example# ping -c 1 192.168.1.1 PING 192.168.1.1 (192.168.1.1): 56 data bytes 64 bytes from 192.168.1.1: icmp_seq=0 ttl=64 time=1.578 ms example# traceroute 192.168.1.38 traceroute to 192.168.1.38 (192.168.1.38), 64 hops max, 52 byte packets 1 host.home (192.168.1.38) 0.058 ms 0.026 ms 0.021 ms example# traceroute 192.168.1.1 traceroute to 192.168.1.1 (192.168.1.1), 64 hops max, 52 byte packets 1 router.home (192.168.1.1) 1.289 ms 1.283 ms 1.232 ms example# ping freebsd.org PING freebsd.org (69.147.83.40): 56 data bytes ping: sendto: No route to host example# traceroute freebsd.org traceroute: findsaddr: failed to connect to peer for src addr selection. example# ssh 192.168.1.38 PRNG is not seeded host# ssh 192.168.1.100 ssh: connect to host 192.168.1.100 port 22: Connection refused host# ping -c 1 192.168.1.100 PING 192.168.1.100 (192.168.1.100): 56 data bytes 64 bytes from 192.168.1.100: icmp_seq=0 ttl=64 time=0.044 ms host# traceroute 192.168.1.100 traceroute to 192.168.1.100 (192.168.1.100), 64 hops max, 52 byte packets 1 PC5.home (192.168.1.100) 0.055 ms 0.030 ms 0.022 ms