BSD Jails, a Better Virtual Server? 61
gManZboy writes "Poul-Henning Kamp, a FreeBSD committer, has an article up about BSD Jails as part of Queue's special report on virtual machines. He describes BSD's interesting 'semi-permeable' approach to VMs, and the importance of security in VM architectures. The article is co-written by Robert Watson, a DARPA principal investigator in the Host Intrusion Protection (HIP) Research Group at McAfee Research."
How is this different? (Score:2, Interesting)
Re:How is this different? (Score:4, Interesting)
http://www.golden-gryphon.com/blog/manoj/softwa
I don't know that's not a direct answer to your question, but I think it's one of the main differences between doing this sort of thing on BSD and Linux.
Re:How is this different? (Score:5, Funny)
If that doesn't confuse the users and crackers alike, I don't know what will....
Re:How is this different? (Score:4, Funny)
thinking about it, it would probably work.
Comment removed (Score:5, Informative)
Re:How is this different? (Score:5, Informative)
Indeed, that is exactly what some hosting companies are doing. I played around inside a BSD jail as root with one of these $15 / month virtual servers. It actually worked Very well, allowing me to compile my own applications including installing the BSD ports collection. I'm quite impressed. Apparently this hosting company runs up to 120 jails per system. The system I was on only had about 30, and I was seeing loads of up to 20. For this reason, I canceled the account, but the concept is quite sound.
The BSD jail more like a super chroot than usermode linux- a LOT more isolation than just the file system, but less than a true VM. It seems to have much less overhead than a full VM such as vmware or UML. Hardware is not virtualized, but rather just more restricted.
This is great for running things like mail servers, web servers, etc. especially where you want to give applications the ability to run external scripts / CGI's without most the security issues that come along with it.
Re:How is this different? (Score:3, Informative)
One non-obvious point is that the chroot directory need not be a full (or even partial) FreeBSD installation. At one time I managed to do a complete Gentoo install using FreeBSD's Linux emulation and pointed the "jail" command at that directory. Voila - a full simulated Linux environment. Other than the inability to load Linux kernel modules, it looked and acted pretty much exactly
Re:How is this different? (Score:3, Informative)
The idea revolves around isolated contexts, each with a different IP address - so in practice you access each of the vservers as a different machine, with its own filesystem, users, processes, semaphores,
As you can chroot your applications to make them see different parts of the filesystem as
Re:How is this different? (Score:4, Informative)
Common, jail appeared in FreeBSD in 1999 and Vserver patches appeared in when, 2001 ?
Re:How is this different? (Score:3, Interesting)
I believe somewhere on the VServer pages it mentions that it is basically the same thing as FreeBSD jail, so the inspiration most definitely comes from FreeBSD.
However, I think the Linux VServer people right now have a leg up on FreeBSD jails. I really like the idea of contexts 0 and 1, where 'killall -HUP named' does not result in all named's in jails be restarted and ps and top aren't cluttered with jailed processes. The un
Re:How is this different? (Score:2)
Yep, that is a very nice idea, it is however seldom needed in practise. Why?
First of all, your 'host' environment should nto be used to run anything like named or such, rather, it should be used to start, stop and administer jails. If you do o
Re:How is this different? (Score:2)
So if I give root password to one of the contexts to a user, and he proceeds to owerwrite the C library with "youresmartbutiamsmarterthanyouresmartbut..." I'm screwed ?
Of course, you might make one context into an NFS server and have others mount the / filesystem through it (or just mount it rea
FreeBSD 4.10 Jail (Score:5, Informative)
- UDP Kernel bug [freebsd.org] that breaks SNMP (eg: mrtg) inside a jail
- ICMP inside jail [nether.net] needs to be split out better to prevent ugly hacks/kernel patches being required
- PostgreSQL needs sysvipc
I've managed to work around these various issues (running mrtg from the "jail-side" host, making it chroot to my directories to run. Enabling the required sysctls, including my own kernel patch to let ping/traceroute work..It lets me and others share a single host that is very beefy (2x2.8G Xeon, 4g ram, 315g raid-5 ultra-320 disk, etc..) on a fast link. The FreeBSD-5 jail subsystem is a bit more refined than that in FreeBSD-4... I'm pondering upgrading the system, but haven't done so yet.. You can also put a small bit of effort into the system and use rsync to keep various (important) system binaries (eg: sshd, sendmail) in-sync across all the systems so they're bug-free if an advisory comes out.. but that's basic sysadmin/patching stuff, not anything jail specific.. but if their jail is r00ted, i don't need to worry about my own files being compromised, unless they get at the 'host' system.. (which runs no services to speak of)...
This is no laughing matter. (Score:4, Funny)
Research is not supposed to be "hip". It is a very somber and serious process. I think it's shameful how these researchers would rather run the streets with their "rad crew" than commit to serious discovery. For shame.
Re:Are BSD jails the only option? (Score:5, Funny)
Wow, what an interesting comment! "Linux 2.?.? has a whoosit something whatcha hoo hoo I heard someone maybe talk about? It's better than BSD, tho!"
Re:Are BSD jails the only option? (Score:1)
Re:Are BSD jails the only option? (Score:2, Interesting)
http://www.nsa.gov/selinux/
Stuff like Selinux though and NX should be considered as the last line of defence though, because they wont prevent people crashing the daemon, and can be circumvented..
Re:Are BSD jails the only option? What about distr (Score:1)
Re:Are BSD jails the only option? (Score:3, Insightful)
This may be the case, but for many Linux users these security improvements are not easily available since they are not supported by the major Linux distributions.
As an example, OpenBSD [openbsd.org] supports and integrates various technologies out of the box, while similar technologies is unavailable for most [undeadly.org] Linux users. Unless you do a huge amount of work, and have the required knowledge to patch your system, of course.
It's like the old
Re:Are BSD jails the only option? (Score:2)
Re:One drawback to jails (Score:3, Informative)
Re:One drawback to jails (Score:2, Informative)
Re:One drawback to jails (Score:2, Informative)
Re:One drawback to jails (Score:2)
Unless you add unofficial (for now?) patches, true.
> So you need one unique IP for each Jail on a machine.
Not true. If you know what you are doing, 2 or more jails can share an IP. It is not advisable to do this because it gets very confusing very quickly, and since this is a security measure first of all, confusion for the admoin is really the last thing that you want.
That said, I currently use exactly such a setup (multiple jails shar
Zones (Score:4, Interesting)
Re:Zones (Score:2)
Robert Watson (Score:4, Informative)
jail paper (Score:3, Informative)
Recommendations for providers? (Score:2)
Re:Recommendations for providers? (Score:1, Informative)