This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
технология_jail [2012/06/23 23:48] val |
технология_jail [2015/05/13 11:13] val [FreeBSD10.X] |
||
---|---|---|---|
Line 1: | Line 1: | ||
====== Технология jail ====== | ====== Технология jail ====== | ||
- | [[http://ru.wikipedia.org/wiki/FreeBSD_Jail]] | + | * [[http://ru.wikipedia.org/wiki/FreeBSD_Jail|FreeBSD Jail]] |
+ | * [[http://www.freebsd.org/doc/handbook/jails-build.html|Creating and Controlling Jails]] | ||
+ | * [[http://www.unixfaq.ru/index.pl?req=qs&id=1002|Управление переменными ядра в Jail]] | ||
- | [[http://www.freebsd.org/doc/handbook/jails-build.html]] | + | ===== Создание копии системы ===== |
+ | |||
+ | ==== С использованием дистрибутива ==== | ||
+ | |||
+ | |||
+ | ==== С использованием компиляции и установки "мира" системы ==== | ||
+ | |||
+ | === Подготовка исходных текстов === | ||
+ | |||
+ | * [[Обновление системы и базового ПО в FreeBSD#Установка исходных текстов]] | ||
+ | * [[Обновление системы и базового ПО в FreeBSD#Установка заплаток внутри релиза]] | ||
+ | |||
+ | === Сборка "мира" (несколько часов) === | ||
- | ===== Создание "мира" ===== | ||
- | Инсталлируем исходные тексты системы | ||
- | <code> | ||
- | [server:~] # freebsd-update fetch | ||
- | [server:~] # freebsd-update install | ||
- | </code> | ||
- | Следующее действие занимает несколько часов: | ||
<code> | <code> | ||
[server:~] # cd /usr/src | [server:~] # cd /usr/src | ||
[server:~] # make buildworld | [server:~] # make buildworld | ||
</code> | </code> | ||
+ | |||
+ | === Установка копии "мира" (5-7 минут) === | ||
<code> | <code> | ||
Line 24: | Line 33: | ||
[server:~] # make distribution DESTDIR=$D | [server:~] # make distribution DESTDIR=$D | ||
</code> | </code> | ||
+ | |||
+ | ===== Совместное использование дерева портов ===== | ||
+ | |||
<code> | <code> | ||
[server:~] # mount_nullfs /usr/ports/ /var/jail/www/usr/ports | [server:~] # mount_nullfs /usr/ports/ /var/jail/www/usr/ports | ||
Line 29: | Line 41: | ||
===== Запуск jail ===== | ===== Запуск jail ===== | ||
+ | |||
+ | ==== FreeBSD10.X ==== | ||
+ | |||
+ | * [[http://therub.org/2014/08/11/convert-freebsd-jails-from-rc.conf-to-jail.conf/|Convert FreeBSD 10 Jails from rc.conf to jail.conf]] | ||
<code> | <code> | ||
[server:~] # cat /etc/rc.conf | [server:~] # cat /etc/rc.conf | ||
+ | </code><code> | ||
... | ... | ||
jail_enable="YES" | jail_enable="YES" | ||
jail_list="www" | jail_list="www" | ||
- | jail_www_rootdir="/opt/jail/www" | + | </code><code> |
- | jail_www_hostname="www.class.un" | + | [server:~] # cat /etc/jail.conf |
+ | </code><code> | ||
+ | allow.raw_sockets = 1; | ||
+ | exec.clean; | ||
+ | exec.system_user = "root"; | ||
+ | exec.jail_user = "root"; | ||
+ | exec.start += "/bin/sh /etc/rc"; | ||
+ | exec.stop = "/bin/sh /etc/rc.shutdown"; | ||
+ | exec.consolelog = "/var/log/jail_www_console.log"; | ||
+ | mount.devfs; | ||
+ | allow.set_hostname = 0; | ||
+ | allow.sysvipc = 0; | ||
+ | |||
+ | www { | ||
+ | host.hostname = "www.corpX.un"; | ||
+ | path = "/var/jail/www"; | ||
+ | interface = "em0"; | ||
+ | ip4.addr += "em0|192.168.X.20/32"; | ||
+ | } | ||
+ | </code><code> | ||
+ | [server:~] # service jail start | ||
+ | </code> | ||
+ | |||
+ | ==== FreeBSD8.X ==== | ||
+ | <code> | ||
+ | [server:~] # cat /etc/rc.conf | ||
+ | </code><code> | ||
+ | ... | ||
+ | jail_enable="YES" | ||
+ | jail_list="www" | ||
+ | jail_www_rootdir="/var/jail/www" | ||
+ | jail_www_hostname="www.corpX.un" | ||
jail_www_interface="em0" | jail_www_interface="em0" | ||
jail_www_ip="192.168.X.20" | jail_www_ip="192.168.X.20" | ||
jail_www_devfs_enable="YES" | jail_www_devfs_enable="YES" | ||
jail_www_devfs_ruleset="devfsrules_jail" | jail_www_devfs_ruleset="devfsrules_jail" | ||
+ | </code><code> | ||
[server:~] # sysctl security.jail.allow_raw_sockets=1 | [server:~] # sysctl security.jail.allow_raw_sockets=1 | ||
Line 50: | Line 98: | ||
[server:~] # jls | [server:~] # jls | ||
- | [server:~] # sysctl security.jail.list | + | [server:~] # jexec N csh |
- | + | ||
- | [server:~] # jexec 10 csh | + | |
www# sysctl security.jail.jailed | www# sysctl security.jail.jailed | ||
Line 67: | Line 113: | ||
</code><code> | </code><code> | ||
domain corpX.un | domain corpX.un | ||
- | nameserver 192.168.X.10 | + | nameserver 172.16.1.254 |
</code><code> | </code><code> | ||
www# cat /etc/hosts | www# cat /etc/hosts | ||
Line 74: | Line 120: | ||
192.168.X.20 www.corpX.un www | 192.168.X.20 www.corpX.un www | ||
+ | |||
+ | 172.16.1.249 rep | ||
</code> | </code> | ||