Am Freitag, 5. März 2004 00:31 schrieb Chris Meyers:
> I need to set up a new mail server at a different building, so I thought
> I would put sendmail and its services (virus scanning etc.) in a jail to
> be a bit more secure. I thought that before I do this for real I would
> try setting up a jail on a test server and see if I can ssh to it and
> generally get things to work. I can't.
> Here's what I have set up so far. I found a couple how-tos and I am
> following them; one is an ONLamp article
> (, and the other
> is the jails section of the AbsoluteBSD book. I am running 5.1.
> On the server I set up a /usr/jail directory to put the jail into. Then
> I ran the following from /usr/src/:
> # make world DESTDIR=/usr/jail
> # cd etc
> # make distribution DESTDIR=/usr/jail
> # cd /usr/jail/dev
> # sh MAKEDEV jail
> This is where I had my first problem, MAKEDEV doesn't exist. At first I
> was a bit concerned about this, then I remembered that in 5.0 and above
> MAKEDEV isn't necessary, it is handled by the kernel (If that isn't
> right someone please tell me). I didn't worry about this.
> Next I ran:
> # cd ../
> # ln -sf /dev/null kernel
> Then I started my jail:
> #jail /usr/jail /bin/sh
> Things seem to be fine. I can see the jailed environment and everything
> looks fine. I log out and then try to set up the last configuations so I
> can ssh in and run sendmail. In the non-jail /etc/rc.conf I added the
> following lines:
> ifconfig_fxp0_alias0=" netmask"

This is wrong. The jail can only have one IP so netmask has to be 0xffffffff 
Do you have something like this on the host?
fconfig_fxp0="inet  netmask 0xffffff00"     #host
ifconfig_fxp_alias0="inet netmask 0xffffffff"    #jail 1 

> sendmail_enable="NONE"
> inetd_flags="-wW -a"
> I also added ListenAddress to /etc/ssh/sshd_config.
> In the jail's /etc/rc.conf (i.e. /usr/jail/etc/rc.conf) I added:
> portmap_enable="NO"
> ifconfig_fxp0="inet netmask"
> sendmail_enable="YES"
> sshd_enable="YES"
> and added ListenAddress to /usr/jail/etc/ssh/sshd_config

This isn't neccessary, since the jail has only that one IP.
IT's important that the host is limited to one address like you wrote a few 
lines above!

Change the IP like I wrote above and everything should be fine.


> I then rebooted to shut all services down. When the system was back up
> and running I ran the commands to mount and start the jail:
> # mount -t procfs proc /usr/jail/proc
> # jail /usr/jail /bin/sh /etc/rc
> Things seem to "boot" fine until it gets to sendmail; it seems to hang
> there (sshd starts fine though). Eventually sendmail times out and I get
> a prompt. I figure my jail is running (minus sendmail which I don't care
> about at the moment), and a ps -ax|grep J shows a few jailed processes
> running including sshd. From another system I try:
> % ssh
> and I get nothing. I can ping just fine (as well as
> A sockstat -4 shows:
> root     sshd       3041  3  tcp4         *:*
> root     syslogd    2908  4  udp4        *:*
> root     sshd       2650  3  tcp4         *:*
> so it seems like sshd is listening on and 203. I can ssh to
> 202 without problem, I just can't get into the jail.
> Can anybody tell me where I screwed up, or other things to look for. Any
> help would be appreciated.
> Thanks,
> Chris

Attachment: pgp00000.pgp
Description: signature

Reply via email to