BSD Jails - "Stretching the most able"?

[Ephelyon]

Following a protracted love affair with FreeBSD recently, I'm now launching an after-school club to "stretch the most able" in Computer Science by offering 100 FreeBSD jails to which students can have full root access, run servers and generally play around with, safe in the knowledge that any mess-ups can be restored from a jail archive if necessary. I'm only going to have the VM running during club hours to minimise abuse (as these jails will need Internet access to do anything very useful, e.g. installing packages).

 

I thought I'd share the method as it's relatively easy to set up. Because a jail is essentially a chroot on steroids (i.e. each has its own unique IP), sharing the same host kernel but not involving full-on virtualisation, the VM doesn't need much grunt (only 2 cores and 4GB RAM here at the moment). FreeBSD images for different hypervisors are downloadable from here, though you'll probably want to embiggen the virtual disk before starting the VM (as each jail gets up to 1GB space if you follow the process below exactly). The following are all the commands needed to take a fresh VM image from scratch to where mine is now.

 

So... we've logged in as "root" with no password. First, let's be British:

 

kbdcontrol -l uk

 

Next, let's give "root" a password:

 

passwd

 

Now, we want to create a setup script to do all the work for us:

 

vi setup.sh

 

Press the Insert key within vi to enter text, then copy and paste the following into this screen, changing the values in italics as appropriate (I'd do this beforehand). Also note that "hn0" (in bold) may be different on different hypervisors - the below is from Hyper-V, while on ESXi it would be em0:

 

#!/bin/sh
gpart recover da0
gpart resize -i 3 da0
growfs -y /dev/gpt/rootfs
echo keymap=\"uk\">/etc/rc.conf
echo hostname=\"[i]ChosenHostName[/i].[i]YourDomainName[/i]\">>/etc/rc.conf
echo ifconfig_[b]hn0[/b]=\"inet [i]ChosenIP[/i] netmask [i]YourNetMask[/i]\">>/etc/rc.conf
echo defaultrouter=\"[i]YourGateway[/i]\">>/etc/rc.conf
echo sshd_enable=\"YES\">>/etc/rc.conf
echo qjail_enable=\"YES\">>/etc/rc.conf
echo search [i]YourDomainName[/i]>/etc/resolv.conf
echo nameserver [i]YourDNSServer[/i]>>/etc/resolv.conf
echo PermitRootLogin yes>>/etc/ssh/sshd_config
echo net.inet.ip.portrange.randomized=0>>/etc/sysctl.conf
sysctl net.inet.ip.portrange.randomized=0
/etc/rc.d/netif restart
/etc/rc.d/routing restart
service sshd start
portsnap fetch extract
env ASSUME_ALWAYS_YES=YES pkg upgrade
env ASSUME_ALWAYS_YES=YES pkg install qjail
qjail install
qjail update -p
qjail create -n [b]hn0[/b] -d 100 -c -i 1g -4 [i]StartingIP[/i] student
qjail config -k student=
qjail start
qjail stop
qjail archive -A

 

Once pasted in, press Escape to leave text-entry mode, then save and close the file with the following command in vi:

 

:wq

(and press Enter)

 

Then we make our script executable with:

 

chmod +x setup.sh

 

And now we run it with:

 

./setup.sh

 

(For StartingIP, if my VM is going to be 172.16.7.100 and I'm creating 100 jails, I would use 172.16.7.101 here as I would then have the host and jails using .100 and then .101 to .200, respectively)

 

Using the script above, jails will be created as "student-001" through "student-100". I then used "dnscmd" with a "for" loop on our domain controller to bulk-create the DNS entries for these so students can get to them more easily. There will be a built-in user whose name and initial password are the same as the jail name.

 

I've got two people interested in the club so far. Anyone else care to try it out where you are?

Edited February 16, 2017 by Ephelyon

[Ephelyon]

UPDATE:

 

"da0" may also be "ada0" on some hypervisors.

[synaesthesia]

That's interesting. We have a couple of students who may benefit from this. I've heard briefly of BSD jails before but never really looked into them, this has given a very quick insight into them.

May have to look into this further. I've little doubt a couple of students would benefit but not sure we have the staff that would be able to actually help nurture them with it

[Ephelyon]

Same here... that's why I'll be going along to the club so we can all have a play around together and students can ask me questions in real-time.

 

A powerful demonstrator of how easily people can get started inside their jail would be:

 

pkg install nginx
service nginx onestart

 

BOOM - web server running!

 

 

@garethedmondson - what say you?

Edited February 19, 2017 by Ephelyon

[Geoff]

Linux equivalent is LXC. You've also got Docker Containers which is used in the real world™.

 

All good stuff though.

[Ephelyon]

Yes, or Zones on Solaris - they all have real-world applications!

 

The main reasons I'd go for FreeBSD over Linux or Solaris are:

 

1) Stability - jails have existed since FreeBSD 4.0;

2) Performance - FreeBSD's emphasis is on performance and its raw socket I/O stats can be through the roof. Netflix uses FreeBSD servers for content streaming to millions of users; Microsoft used to use it for Hotmail before the migration to Exchange;

3) Ports - the BSD ports tree is one of the easiest ways to learn the methodology of compiling from source for any package;

4) Bulk operations - I'm using the "qjail" tool for this, as it can create and auto-configure up to 100 jails in bulk with a single command.*

 

*Can you do this with LXC/D or Docker? I've looked around but couldn't find any references to this.

Edited February 19, 2017 by Ephelyon

[Ephelyon]

Just playing with this today...

 

Let's say we are in our jail and we want to set up a FAMP stack! We will do the following...

 

Firstly, let's become "root":

 

su

 

Now let's install the packages we need for this:

 

pkg install apache24 mysql56-server mod_php56 php56-mysql php56-mysqli

 

We'll make sure the OS is aware of the new packages we've installed with:

 

rehash

 

We want Apache and MySQL to start with the jail, so let's add the required lines to /etc/rc.conf to make that happen using the built-in tool for this:

 

sysrc apache24_enable="YES"
sysrc mysql_enable="YES"

 

Next, let's set up PHP. We'll need a php.ini file, so let's copy the default production-ready one into place:

 

cp /usr/local/etc/php.ini-production /usr/local/etc/php.ini

 

Now we need to set up Apache to use PHP, so we'll create a php.conf file to do so:

 

vi /usr/local/etc/apache24/Includes/php.conf

 

We'll need to copy and paste the following into it (in the same manner as my original post):

 

   DirectoryIndex index.php index.html
   
       SetHandler application/x-httpd-php
   
   
       SetHandler application/x-httpd-php-source
   

 

Then save and close.

 

We'll also want to be able to test our PHP functionality, so let's create a .php file in our web server's root directory for that purpose:

 

vi /usr/local/www/apache24/data/info.php

 

We can copy and paste the following into it for our purposes:

 

 

Now we come to MySQL. This next step is often left out of tutorials. Inside a jail, the "mysql" user can't write to /tmp by default, so let's rectify that:

 

chmod 1777 /tmp

 

So now we want to start the MySQL daemon:

 

service mysql-server start

 

MySQL installations aren't all that secure by default, so let's run a pre-packaged script to sort that out like so:

 

mysql_secure_installation

 

We should then restart MySQL to use the new configuration:

 

service mysql-server restart

 

Finally, let's start Apache:

 

service apache24 start

 

Voilà! If we browse to our jail's IP address, we should now see the default Apache page. If we add /info.php to the end of that URL, we should see some PHP config details that confirm PHP is up and running too. Testing MySQL would be rather more involved, but at least we know it's working because the "mysql_secure_installation" ran successfully against it (it would fail otherwise).

 

What do people think? Could the above be a good first session to work through for a club?

Edited February 19, 2017 by Ephelyon