Typos and nits.
This commit is contained in:
parent
4658dc8325
commit
3e580b38ba
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=129466
@ -73,10 +73,10 @@ to create a "virtual system image" running a variety of daemons and
|
||||
services.
|
||||
In both cases, a fairly complete file system install of FreeBSD is
|
||||
required, so as to provide the necessary command line tools, daemons,
|
||||
libraries, application configuration files, etc are available.
|
||||
libraries, application configuration files, etc.
|
||||
However, for a virtual server configuration, a fair amount of
|
||||
additional work is required so as to configure the "boot" process.
|
||||
This man page documents the configuration steps necessary to support
|
||||
This manual page documents the configuration steps necessary to support
|
||||
either of these steps, although the configuration steps may be
|
||||
refined based on local requirements.
|
||||
.Pp
|
||||
@ -85,7 +85,7 @@ Please see the
|
||||
man page for further details.
|
||||
.Sh EXAMPLES
|
||||
.Ss "Setting up a Jail Directory Tree"
|
||||
This example shows how to setup a jail directory tree
|
||||
This example shows how to set up a jail directory tree
|
||||
containing an entire
|
||||
.Fx
|
||||
distribution:
|
||||
@ -110,8 +110,8 @@ See
|
||||
for information on how to use devfs rules to limit access to entries
|
||||
in the per-jail devfs.
|
||||
.Pp
|
||||
In many cases this example would put far more stuff in the jail than is needed.
|
||||
In the other extreme case a jail might contain only one single file:
|
||||
In many cases this example would put far more in the jail than needed.
|
||||
In the other extreme case a jail might contain only one file:
|
||||
the executable to be run in the jail.
|
||||
.Pp
|
||||
We recommend experimentation and caution that it is a lot easier to
|
||||
@ -166,8 +166,8 @@ Other daemons
|
||||
will need to be manually configured\(emfor some this is possible through
|
||||
the
|
||||
.Xr rc.conf 5
|
||||
flags entries, for others it is necessary to modify per-application
|
||||
configuration files, or to recompile the application.
|
||||
flags entries; for others it is necessary to modify per-application
|
||||
configuration files, or to recompile the applications.
|
||||
The following frequently deployed services must have their individual
|
||||
configuration files modified to limit the application to listening
|
||||
to a specific IP address:
|
||||
@ -203,9 +203,9 @@ Attempting to serve
|
||||
NFS from the host environment may also cause confusion, and cannot be
|
||||
easily reconfigured to use only specific IPs, as some NFS services are
|
||||
hosted directly from the kernel.
|
||||
Any third party network software running
|
||||
Any third-party network software running
|
||||
in the host environment should also be checked and configured so that it
|
||||
does not bind all IP addresses, which would result in those services also
|
||||
does not bind all IP addresses, which would result in those services' also
|
||||
appearing to be offered by the jail environments.
|
||||
.Pp
|
||||
Once
|
||||
@ -216,20 +216,20 @@ to a jail, and its sendmail is down, the mail is delivered to the host,
|
||||
etc.)
|
||||
.Ss Configuring the Jail
|
||||
.Pp
|
||||
Start any jails for the first time without configuring the network
|
||||
Start any jail for the first time without configuring the network
|
||||
interface so that you can clean it up a little and set up accounts.
|
||||
As
|
||||
with any machine (virtual or not) you will need to set a root password, time
|
||||
zone, etc.
|
||||
Some of these steps apply only if you intend to run a full virtual server
|
||||
inside the jail; others apply for both constraining a particular application
|
||||
or for a virtual server.
|
||||
inside the jail; others apply both for constraining a particular application
|
||||
or for running a virtual server.
|
||||
.Pp
|
||||
Start a shell in the jail:
|
||||
.Pp
|
||||
.Dl "jail /data/jail/192.168.11.100 testhostname 192.168.11.100 /bin/sh"
|
||||
.Pp
|
||||
You will end up with a shell prompt, assuming no errors, within the jail.
|
||||
Assuming no errors, you will end up with a shell prompt within the jail.
|
||||
You can now run
|
||||
.Pa /usr/sbin/sysinstall
|
||||
and do the post-install configuration to set various configuration options,
|
||||
@ -303,7 +303,7 @@ jail, you may wish to consider setting the
|
||||
.Va security.jail.set_hostname_allowed
|
||||
sysctl variable to 0.
|
||||
Please see the management discussion later in this document as to why this
|
||||
is a good idea.
|
||||
may be a good idea.
|
||||
If you do decide to set this variable,
|
||||
it must be set before starting any jails, and once each boot.
|
||||
.Bd -literal -offset indent
|
||||
@ -417,12 +417,12 @@ the
|
||||
.Dv IP_HDRINCL
|
||||
flag has been set on the socket.
|
||||
.It Va security.jail.getfsstatroot_only
|
||||
This MIB entry determines whether or not processes within a jail is able
|
||||
This MIB entry determines whether or not processes within a jail are able
|
||||
to see data for all mountpoints.
|
||||
When set to 1 (default),
|
||||
When set to 1 (default), the
|
||||
.Xr getfsstat 2
|
||||
system call only return (while called by jailed processes) the data for
|
||||
the file system on which jail's root vnode is located.
|
||||
system call returns only (when called by jailed processes) the data for
|
||||
the file system on which the jail's root vnode is located.
|
||||
Note: this also has the effect of hiding other mounts inside a jail,
|
||||
such as
|
||||
.Pa /dev ,
|
||||
@ -529,7 +529,7 @@ address alias flag such that daemons listening on all IPs
|
||||
will not bind on that address, which would facilitate building a safe
|
||||
host environment such that host daemons do not impose on services offered
|
||||
from within jails.
|
||||
Currently, the simplist answer is to minimize services
|
||||
Currently, the simplest answer is to minimize services
|
||||
offered on the host, possibly limiting it to services offered from
|
||||
.Xr inetd 8
|
||||
which is easily configurable.
|
||||
|
Loading…
Reference in New Issue
Block a user