Hi, Running: Freebsd 6.0 I am wondering if it is possible to have acces to loopback ip in a jail. I currently have a server running a jail. In the jail, there is a database and a web server. I would like to be able to have the database only bind on a loopback address and not on the jail's ip. Can this be done and how? Thanks -Cyril __________________________________________________________ L?che-vitrine ou l?che-?cran ? magasinage.yahoo.ca
Hi Cyril, For access loopback inside the jail, is necessary configure in host server alias for loopback and start jail using loopback. Remember loopback address is all 127/8 ! Ex. rc.conf ifconfig_lo0_alias0="inet 127.0.0.2 netmask 0xffffffff" jail_packages_rootdir="/jail/packages" jail_packages_hostname="packages.xxx.xxx" jail_packages_ip="127.0.0.2" jail_packages_exec_start="/bin/sh /etc/rc" jail_packages_exec_stop="/bin/sh /etc/rc.shutdown" jail_packages_devfs_enable="YES" jail_packages_fdescfs_enable="NO" jail_packages_procfs_enable="NO" jail_packages_mount_enable="YES" jail_packages_devfs_ruleset="devfsrules_jail" jail_packages_fstab="/etc/fstab.packages" Ricardo A. Reis UNIFESP Unix and Network Admin> Hi, > > Running: Freebsd 6.0 > > I am wondering if it is possible to have acces to loopback ip in a jail. I > currently have a server running a jail. In the jail, there is a database and a > web server. I would like to be able to have the database only bind on a > loopback address and not on the jail's ip. > > Can this be done and how? > > Thanks > > -Cyril > > > > > > > __________________________________________________________ > L?che-vitrine ou l?che-?cran ? > magasinage.yahoo.ca > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" > >
I recently did something like this. I have a webserver in a jail that needs to talk to a database, and the webserver is the only thing that should talk to the databse. My solution was to use 2 jails: one for the webserver, and another for the database. A jail can only bind to one IP. Presumably you want the webserver to be able to talk out of the box, so having the webserver jail bind to a loop-back address isn't really the way to go (without getting unnecessariy complex with all sorts of NATing and forwarding firewall rules). Jail 1: * runs webserver * binds to real interface with real, routable IP Jail 2: * runs database server * binds to loopback interface, isn't directly reachable from outside the box As a further piece of advice, if you're using jails at all, you're probably concerned with security. In case you are, you should always consider firewalling the jail to make sure that it can't reach things that you don't want it to. I usually implement a few stateful firewall rules to make it so that the jail cannot initiate connections outward, because if the jail is compromised, you (probably) want to make it so that it cannot be used as a platform to launch further attacks. For example: ipfw add check-state ipfw add allow tcp from any to $JAIL keep-state setup ipfw add deny ip from any to $JAIL ipfw add deny ip from $JAIL to any Or, if you know that the only service you want to be available on the jail is the web server, why allow any other access at all? ipfw add check-state ipfw add allow tcp from any to $JAIL 80 keep-state setup ipfw add deny ip from any to $JAIL ipfw add deny ip from $JAIL to any You would, of course, have to modify these rules to accomodate your database. On Tue, 7 Mar 2006, Cyril Jaouich wrote:> Hi, > > Running: Freebsd 6.0 > > I am wondering if it is possible to have acces to loopback ip in a jail. I > currently have a server running a jail. In the jail, there is a database and a > web server. I would like to be able to have the database only bind on a > loopback address and not on the jail's ip. > > Can this be done and how? > > Thanks > > -Cyril > > > > > > > __________________________________________________________ > Lèche-vitrine ou lèche-écran ? > magasinage.yahoo.ca > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" >/-------------------------------------------------------------------------/ "I'm busy. What, you think these web-sites are gonna surf themselves???" finger://bigby@ephemeron.org http://www.ephemeron.org/~bigby/ irc://irc.ephemeron.org/#the_pub /-------------------------------------------------------------------------/
For what its worth. It seems like it would be a better idea to use the file socket instead of connecting to an IP. You could then mount the socket within the jail, if I am not mistaken. ---- Joshua Bell - <josh@oplink.net> Cyril Jaouich wrote:> Hi, > > Running: Freebsd 6.0 > > I am wondering if it is possible to have acces to loopback ip in a jail. I > currently have a server running a jail. In the jail, there is a database and a > web server. I would like to be able to have the database only bind on a > loopback address and not on the jail's ip. > > Can this be done and how? > > Thanks > > -Cyril > > > > > > > __________________________________________________________ > L?che-vitrine ou l?che-?cran ? > magasinage.yahoo.ca > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" >