kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
freebsd-ports/sysutils/qjail/pkg-plist

60 lines
2.2 KiB
Text
Raw Normal View History

Qjail [ q = quick ] is a 4th generation wrapper for the basic chroot jail system that includes security and performance enhancements. Plus a new level of "user friendliness" enhancements dealing with deploying just a few jails or large jail environments consisting of 100's of jails. Qjail requires no knowledge of the jail command usage. It uses "nullfs" for read-only system binaries, sharing one copy of them with all the jails. Uses "mdconfig" to create sparse image jails. Sparse image jails provide a method to limit the total disk space a jail can consume, while only occupying the physical disk space of the sum size of the files in the image jail. Ability to assign ip address with their network device name, so aliases are auto created on jail start and auto removed on jail stop. Ability to create "ZONE"s of identical qjail systems, each with their own group of jails. Ability to designate a portion of the jail name as a group prefix so the command being executed will apply to only those jail names matching that prefix. WWW: http://sourceforge.net/projects/qjail/ http://qjail.sourceforge.net/ PR: ports/148777 Submitted by: Joe Barbish <joeb@a1poweruser.com> Approved by: rene (mentor)
2011-06-11 23:22:20 +02:00
bin/qjail
Update to version 3.0 PR: ports/179184 Submitted by: Joe Barbish <qjail@a1poweruser.com> (maintainer)
2013-06-03 00:13:33 +02:00
bin/qjail.vnet.be
bin/qjail.vnet.ng
Update to 2.1; 1. Added logic to interrogate the content of flavors for correctness before allowing them to be merged into the newjail being created. Only paths targeting directories holding configuration files are allowed now. The jail create process is terminated and the offending paths are listed in error messages. 2. Changed the /root/.cshrc file in both flavors default and ssh-default to now contain setenv PACKAGESITE to point to packages-current so login users of any jail will have the most current package version available. 4. In the qjail install logic added code to create these additional paths in basejail, /usr/ports/packages, /usr/home and /home link. 5. The create -D -I options have been combined to just -d. 6. The create -i -s options have been combined to just -i. 7. The create -c & -C options have been reduced to just -c. 8. The create options -c and -f ssh-default now force the first time login user to enter a new password. 9. Added logic to create, that rolls through the ip addresses of the existing jails to verify the ip address/addresses on the create command are not all ready used. 10. Corrected the list command display format when jail has more than a single ip address. 11. Changed the order jails are started, stopped, restarted, and listed from <z to a> to <a to z>. Also for boot starts. 12. Added system wide logging. Every qjail subcommand and error message is logged to /var/log/qjail.log. Rotating of the log is enabled. 13. The install subcommand has new -l option to activate system wide logging. 14. The update subcommand has [-l on|off] option to turn logging on and off. 15. Added new subcommand logmsg. This posts comments to the log file. 16. Changed update option to use its own /usr/local/etc/qjail.portsnap.conf file instead of the hosts /etc/portsnap.conf. Enabled REFUSE statements in /usr/local/etc/qjail.portsnap.conf to drop categories most likely to never be used to compile ports inside of a jail. 17. As sparse image allocations get larger 1G -> 5G creating jails from archives was taking very long times to complete, 20 minutes or more. Archives of sparse images larger that 7G caused terminations. All these things have one thing in common. They all used the pax and cpio utilities. Turns out these utilities are not sparse file aware. Had to completely change the way sparse image jails moved through the qjail system. Now the archive process opens the sparse image and really archives it as a directory tree jail. This required restore and create options to change also. PR: ports/175771 Submitted by: Joe Barbish (maintainer)
2013-02-03 19:45:10 +01:00
etc/qjail.portsnap.conf
Update to version 3.0 PR: ports/179184 Submitted by: Joe Barbish <qjail@a1poweruser.com> (maintainer)
2013-06-03 00:13:33 +02:00
etc/rc.d/qjail.bootime
sysutils/qjail: upgrade 3.2 -> 3.3 1. Fix typo in qjail.8 manual. Change "See jailip below" to "See -4 option" 2. Fix typo in qjail-howto.8 manual as per PR# 186269. Change a comma , inside of ip address to a . period. 73.x.97,51,10.0.10.126 to 73.x.97.51,10.0.10.126 3. Change qjail.portsnap.conf, remove index-6 index-7 index-8 statements replace index-9 with index-10 4. Removed rcvar=`set_rcvar` statement from qjail.bootime script. In Release 10.0 its no longer included in the rc.d scripts and was causing a non-harmful bogus boot time message. But this de-activated the ability to control the selection of boot time starting of jails using the qjail_enable="YES" statement in the hosts /etc/rc.conf. Put rcvar="qjail_enable" in qjail.bootime script and things work as exspected. 5. Correct coding bug in archive logic to archive sharedfs per zone. 6. Correct coding bug for Sanity check to see if any jails are running. 7. Changed "qjail install" logic to check that this version of qjail only runs on release-10.0. This is due to unique properties of jail(8) & rc.d that are not in 9.2 and older releases. 8. Changed "qjail create" and "qjail config" logic to check if the -4 and/or -6 IP address are prefixed with "<if_device>|" and/or suffixed with "/<netmask>" values. jail(8) says this is valid syntax, but its NOT allowed as valid syntax to qjail. 9. Changed "qjail create" logic to check if no -n value was entered. If not then populate the -n value with the interface default nic device name obtained from route command. This is now the automatic default behavior. The default interface is the one connected to the public internet. This shortens the "qjail create command" and forces the use of the automatic creation and deletation of the alias for the jails IP address on that "network interface name". Made appropriate changes to qjail.8 man page documentation. 10. Changed "qjail create" logic to target another zones archives as input source. Now you can use any zones archive file as a template to create a new jail using the existing -a option. New -A option is coded with the zone name of the target archive file name populating the -a value. Made appropriate changes to qjail.8 man page documentation. 11. Added -S option to "qjail update" This option will copy the hosts /usr/src filesystem to sharedfs/usr/src to be shared among all the jails. Made appropriate changes to qjail.8 man page documentation. 12. Add -P option to "qjail update" This option will copy the hosts /usr/ports filesystem to sharedfs/usr/ports to be shared among all the jails. Made appropriate changes to qjail.8 man page documentation. 13. The long time jail(8) bug since 9.1 that deals with the jails /dev directory which allowed the jail to access things jail should be restricted from became fixed with 10.0-RELEASE-p2. The hosts /etc/defaults/rc.conf devfs_load_rulesets="NO" changed to devfs_load_rulesets="YES" Removed the jail.conf work-a-round statments from the qjail script build_config_def routine as they are no longer needed. 14. Converted the Port's Makefile to do "stageing". PR: ports/189120 Submitted by: Joe Barbish (maintainer) Approved by: culot (mentor)
2014-05-15 12:40:19 +02:00
man/man8/qjail.8.gz
man/man8/qjail-intro.8.gz
man/man8/qjail-howto.8.gz
Update to version 3.0 PR: ports/179184 Submitted by: Joe Barbish <qjail@a1poweruser.com> (maintainer)
2013-06-03 00:13:33 +02:00
%%EXAMPLESDIR%%/vnet/ipfw.rules.host
%%EXAMPLESDIR%%/vnet/ipfw.rules.vnet
%%EXAMPLESDIR%%/vnet/ipf.rules.host
%%EXAMPLESDIR%%/vnet/ipf.rules.vnet
%%EXAMPLESDIR%%/vnet/pf.rules.host
%%EXAMPLESDIR%%/vnet/pf.rules.vnet
Qjail [ q = quick ] is a 4th generation wrapper for the basic chroot jail system that includes security and performance enhancements. Plus a new level of "user friendliness" enhancements dealing with deploying just a few jails or large jail environments consisting of 100's of jails. Qjail requires no knowledge of the jail command usage. It uses "nullfs" for read-only system binaries, sharing one copy of them with all the jails. Uses "mdconfig" to create sparse image jails. Sparse image jails provide a method to limit the total disk space a jail can consume, while only occupying the physical disk space of the sum size of the files in the image jail. Ability to assign ip address with their network device name, so aliases are auto created on jail start and auto removed on jail stop. Ability to create "ZONE"s of identical qjail systems, each with their own group of jails. Ability to designate a portion of the jail name as a group prefix so the command being executed will apply to only those jail names matching that prefix. WWW: http://sourceforge.net/projects/qjail/ http://qjail.sourceforge.net/ PR: ports/148777 Submitted by: Joe Barbish <joeb@a1poweruser.com> Approved by: rene (mentor)
2011-06-11 23:22:20 +02:00
%%EXAMPLESDIR%%/default/etc/make.conf
Update to 2.0; Standard maintenance. 1. Added -c option on "qjail create" command that enables ssh access to the jail and creates user account using jailname for id/pw. 2. Added -C option on "qjail create" command that depends on -D option that creates ssh access to jail and creates user account using jailname for id/pw while automatically duplicating jails. 3. Created a customized flavor, ssh-default that enables ssh access to jails. This flavor contains a login account with id/pw of qjail. 4. Removed -c option from "qjail install" because hosts customized /etc caused problems with jail start up. 5. Updated man qjail.8 to reflect the changes. PR: ports/174890 Submitted by: Joe Barbish <qjail@a1poweruser.com> (maintainer)
2013-01-02 11:05:06 +01:00
%%EXAMPLESDIR%%/default/etc/motd
Qjail [ q = quick ] is a 4th generation wrapper for the basic chroot jail system that includes security and performance enhancements. Plus a new level of "user friendliness" enhancements dealing with deploying just a few jails or large jail environments consisting of 100's of jails. Qjail requires no knowledge of the jail command usage. It uses "nullfs" for read-only system binaries, sharing one copy of them with all the jails. Uses "mdconfig" to create sparse image jails. Sparse image jails provide a method to limit the total disk space a jail can consume, while only occupying the physical disk space of the sum size of the files in the image jail. Ability to assign ip address with their network device name, so aliases are auto created on jail start and auto removed on jail stop. Ability to create "ZONE"s of identical qjail systems, each with their own group of jails. Ability to designate a portion of the jail name as a group prefix so the command being executed will apply to only those jail names matching that prefix. WWW: http://sourceforge.net/projects/qjail/ http://qjail.sourceforge.net/ PR: ports/148777 Submitted by: Joe Barbish <joeb@a1poweruser.com> Approved by: rene (mentor)
2011-06-11 23:22:20 +02:00
%%EXAMPLESDIR%%/default/etc/periodic.conf
%%EXAMPLESDIR%%/default/etc/rc.conf
Update to 2.0; Standard maintenance. 1. Added -c option on "qjail create" command that enables ssh access to the jail and creates user account using jailname for id/pw. 2. Added -C option on "qjail create" command that depends on -D option that creates ssh access to jail and creates user account using jailname for id/pw while automatically duplicating jails. 3. Created a customized flavor, ssh-default that enables ssh access to jails. This flavor contains a login account with id/pw of qjail. 4. Removed -c option from "qjail install" because hosts customized /etc caused problems with jail start up. 5. Updated man qjail.8 to reflect the changes. PR: ports/174890 Submitted by: Joe Barbish <qjail@a1poweruser.com> (maintainer)
2013-01-02 11:05:06 +01:00
%%EXAMPLESDIR%%/default/root/.cshrc
sysutils/qjail: upgrade 3.2 -> 3.3 1. Fix typo in qjail.8 manual. Change "See jailip below" to "See -4 option" 2. Fix typo in qjail-howto.8 manual as per PR# 186269. Change a comma , inside of ip address to a . period. 73.x.97,51,10.0.10.126 to 73.x.97.51,10.0.10.126 3. Change qjail.portsnap.conf, remove index-6 index-7 index-8 statements replace index-9 with index-10 4. Removed rcvar=`set_rcvar` statement from qjail.bootime script. In Release 10.0 its no longer included in the rc.d scripts and was causing a non-harmful bogus boot time message. But this de-activated the ability to control the selection of boot time starting of jails using the qjail_enable="YES" statement in the hosts /etc/rc.conf. Put rcvar="qjail_enable" in qjail.bootime script and things work as exspected. 5. Correct coding bug in archive logic to archive sharedfs per zone. 6. Correct coding bug for Sanity check to see if any jails are running. 7. Changed "qjail install" logic to check that this version of qjail only runs on release-10.0. This is due to unique properties of jail(8) & rc.d that are not in 9.2 and older releases. 8. Changed "qjail create" and "qjail config" logic to check if the -4 and/or -6 IP address are prefixed with "<if_device>|" and/or suffixed with "/<netmask>" values. jail(8) says this is valid syntax, but its NOT allowed as valid syntax to qjail. 9. Changed "qjail create" logic to check if no -n value was entered. If not then populate the -n value with the interface default nic device name obtained from route command. This is now the automatic default behavior. The default interface is the one connected to the public internet. This shortens the "qjail create command" and forces the use of the automatic creation and deletation of the alias for the jails IP address on that "network interface name". Made appropriate changes to qjail.8 man page documentation. 10. Changed "qjail create" logic to target another zones archives as input source. Now you can use any zones archive file as a template to create a new jail using the existing -a option. New -A option is coded with the zone name of the target archive file name populating the -a value. Made appropriate changes to qjail.8 man page documentation. 11. Added -S option to "qjail update" This option will copy the hosts /usr/src filesystem to sharedfs/usr/src to be shared among all the jails. Made appropriate changes to qjail.8 man page documentation. 12. Add -P option to "qjail update" This option will copy the hosts /usr/ports filesystem to sharedfs/usr/ports to be shared among all the jails. Made appropriate changes to qjail.8 man page documentation. 13. The long time jail(8) bug since 9.1 that deals with the jails /dev directory which allowed the jail to access things jail should be restricted from became fixed with 10.0-RELEASE-p2. The hosts /etc/defaults/rc.conf devfs_load_rulesets="NO" changed to devfs_load_rulesets="YES" Removed the jail.conf work-a-round statments from the qjail script build_config_def routine as they are no longer needed. 14. Converted the Port's Makefile to do "stageing". PR: ports/189120 Submitted by: Joe Barbish (maintainer) Approved by: culot (mentor)
2014-05-15 12:40:19 +02:00
%%EXAMPLESDIR%%/default/usr/local/etc/pkg.conf
Qjail [ q = quick ] is a 4th generation wrapper for the basic chroot jail system that includes security and performance enhancements. Plus a new level of "user friendliness" enhancements dealing with deploying just a few jails or large jail environments consisting of 100's of jails. Qjail requires no knowledge of the jail command usage. It uses "nullfs" for read-only system binaries, sharing one copy of them with all the jails. Uses "mdconfig" to create sparse image jails. Sparse image jails provide a method to limit the total disk space a jail can consume, while only occupying the physical disk space of the sum size of the files in the image jail. Ability to assign ip address with their network device name, so aliases are auto created on jail start and auto removed on jail stop. Ability to create "ZONE"s of identical qjail systems, each with their own group of jails. Ability to designate a portion of the jail name as a group prefix so the command being executed will apply to only those jail names matching that prefix. WWW: http://sourceforge.net/projects/qjail/ http://qjail.sourceforge.net/ PR: ports/148777 Submitted by: Joe Barbish <joeb@a1poweruser.com> Approved by: rene (mentor)
2011-06-11 23:22:20 +02:00
%%EXAMPLESDIR%%/default/usr/local/etc/sudoers
Update to 2.0; Standard maintenance. 1. Added -c option on "qjail create" command that enables ssh access to the jail and creates user account using jailname for id/pw. 2. Added -C option on "qjail create" command that depends on -D option that creates ssh access to jail and creates user account using jailname for id/pw while automatically duplicating jails. 3. Created a customized flavor, ssh-default that enables ssh access to jails. This flavor contains a login account with id/pw of qjail. 4. Removed -c option from "qjail install" because hosts customized /etc caused problems with jail start up. 5. Updated man qjail.8 to reflect the changes. PR: ports/174890 Submitted by: Joe Barbish <qjail@a1poweruser.com> (maintainer)
2013-01-02 11:05:06 +01:00
%%EXAMPLESDIR%%/ssh-default/etc/group
%%EXAMPLESDIR%%/ssh-default/etc/make.conf
%%EXAMPLESDIR%%/ssh-default/etc/master.passwd
%%EXAMPLESDIR%%/ssh-default/etc/motd
%%EXAMPLESDIR%%/ssh-default/etc/passwd
%%EXAMPLESDIR%%/ssh-default/etc/periodic.conf
%%EXAMPLESDIR%%/ssh-default/etc/pwd.db
%%EXAMPLESDIR%%/ssh-default/etc/rc.conf
%%EXAMPLESDIR%%/ssh-default/etc/spwd.db
%%EXAMPLESDIR%%/ssh-default/etc/ssh/sshd_config
%%EXAMPLESDIR%%/ssh-default/root/.cshrc
%%EXAMPLESDIR%%/ssh-default/usr/home/qjail/.cshrc
%%EXAMPLESDIR%%/ssh-default/usr/home/qjail/.login
%%EXAMPLESDIR%%/ssh-default/usr/home/qjail/.login_conf
%%EXAMPLESDIR%%/ssh-default/usr/home/qjail/.mail_aliases
%%EXAMPLESDIR%%/ssh-default/usr/home/qjail/.mailrc
%%EXAMPLESDIR%%/ssh-default/usr/home/qjail/.profile
%%EXAMPLESDIR%%/ssh-default/usr/home/qjail/.rhosts
%%EXAMPLESDIR%%/ssh-default/usr/home/qjail/.shrc
sysutils/qjail: upgrade 3.2 -> 3.3 1. Fix typo in qjail.8 manual. Change "See jailip below" to "See -4 option" 2. Fix typo in qjail-howto.8 manual as per PR# 186269. Change a comma , inside of ip address to a . period. 73.x.97,51,10.0.10.126 to 73.x.97.51,10.0.10.126 3. Change qjail.portsnap.conf, remove index-6 index-7 index-8 statements replace index-9 with index-10 4. Removed rcvar=`set_rcvar` statement from qjail.bootime script. In Release 10.0 its no longer included in the rc.d scripts and was causing a non-harmful bogus boot time message. But this de-activated the ability to control the selection of boot time starting of jails using the qjail_enable="YES" statement in the hosts /etc/rc.conf. Put rcvar="qjail_enable" in qjail.bootime script and things work as exspected. 5. Correct coding bug in archive logic to archive sharedfs per zone. 6. Correct coding bug for Sanity check to see if any jails are running. 7. Changed "qjail install" logic to check that this version of qjail only runs on release-10.0. This is due to unique properties of jail(8) & rc.d that are not in 9.2 and older releases. 8. Changed "qjail create" and "qjail config" logic to check if the -4 and/or -6 IP address are prefixed with "<if_device>|" and/or suffixed with "/<netmask>" values. jail(8) says this is valid syntax, but its NOT allowed as valid syntax to qjail. 9. Changed "qjail create" logic to check if no -n value was entered. If not then populate the -n value with the interface default nic device name obtained from route command. This is now the automatic default behavior. The default interface is the one connected to the public internet. This shortens the "qjail create command" and forces the use of the automatic creation and deletation of the alias for the jails IP address on that "network interface name". Made appropriate changes to qjail.8 man page documentation. 10. Changed "qjail create" logic to target another zones archives as input source. Now you can use any zones archive file as a template to create a new jail using the existing -a option. New -A option is coded with the zone name of the target archive file name populating the -a value. Made appropriate changes to qjail.8 man page documentation. 11. Added -S option to "qjail update" This option will copy the hosts /usr/src filesystem to sharedfs/usr/src to be shared among all the jails. Made appropriate changes to qjail.8 man page documentation. 12. Add -P option to "qjail update" This option will copy the hosts /usr/ports filesystem to sharedfs/usr/ports to be shared among all the jails. Made appropriate changes to qjail.8 man page documentation. 13. The long time jail(8) bug since 9.1 that deals with the jails /dev directory which allowed the jail to access things jail should be restricted from became fixed with 10.0-RELEASE-p2. The hosts /etc/defaults/rc.conf devfs_load_rulesets="NO" changed to devfs_load_rulesets="YES" Removed the jail.conf work-a-round statments from the qjail script build_config_def routine as they are no longer needed. 14. Converted the Port's Makefile to do "stageing". PR: ports/189120 Submitted by: Joe Barbish (maintainer) Approved by: culot (mentor)
2014-05-15 12:40:19 +02:00
%%EXAMPLESDIR%%/ssh-default/usr/local/etc/pkg.conf
Update to 2.0; Standard maintenance. 1. Added -c option on "qjail create" command that enables ssh access to the jail and creates user account using jailname for id/pw. 2. Added -C option on "qjail create" command that depends on -D option that creates ssh access to jail and creates user account using jailname for id/pw while automatically duplicating jails. 3. Created a customized flavor, ssh-default that enables ssh access to jails. This flavor contains a login account with id/pw of qjail. 4. Removed -c option from "qjail install" because hosts customized /etc caused problems with jail start up. 5. Updated man qjail.8 to reflect the changes. PR: ports/174890 Submitted by: Joe Barbish <qjail@a1poweruser.com> (maintainer)
2013-01-02 11:05:06 +01:00
%%EXAMPLESDIR%%/ssh-default/usr/local/etc/sudoers
Update to version 3.0 PR: ports/179184 Submitted by: Joe Barbish <qjail@a1poweruser.com> (maintainer)
2013-06-03 00:13:33 +02:00
@dirrm %%EXAMPLESDIR%%/default/usr/local/etc
@dirrm %%EXAMPLESDIR%%/default/usr/local
@dirrm %%EXAMPLESDIR%%/default/usr
@dirrm %%EXAMPLESDIR%%/default/root
@dirrm %%EXAMPLESDIR%%/default/etc
@dirrm %%EXAMPLESDIR%%/default
Update to 2.0; Standard maintenance. 1. Added -c option on "qjail create" command that enables ssh access to the jail and creates user account using jailname for id/pw. 2. Added -C option on "qjail create" command that depends on -D option that creates ssh access to jail and creates user account using jailname for id/pw while automatically duplicating jails. 3. Created a customized flavor, ssh-default that enables ssh access to jails. This flavor contains a login account with id/pw of qjail. 4. Removed -c option from "qjail install" because hosts customized /etc caused problems with jail start up. 5. Updated man qjail.8 to reflect the changes. PR: ports/174890 Submitted by: Joe Barbish <qjail@a1poweruser.com> (maintainer)
2013-01-02 11:05:06 +01:00
@dirrm %%EXAMPLESDIR%%/ssh-default/usr/home/qjail
@dirrm %%EXAMPLESDIR%%/ssh-default/usr/home
@dirrm %%EXAMPLESDIR%%/ssh-default/usr/local/etc
@dirrm %%EXAMPLESDIR%%/ssh-default/usr/local
@dirrm %%EXAMPLESDIR%%/ssh-default/usr
@dirrm %%EXAMPLESDIR%%/ssh-default/root
@dirrm %%EXAMPLESDIR%%/ssh-default/etc/ssh
@dirrm %%EXAMPLESDIR%%/ssh-default/etc
@dirrm %%EXAMPLESDIR%%/ssh-default
Update to version 3.0 PR: ports/179184 Submitted by: Joe Barbish <qjail@a1poweruser.com> (maintainer)
2013-06-03 00:13:33 +02:00
@dirrm %%EXAMPLESDIR%%/vnet
Qjail [ q = quick ] is a 4th generation wrapper for the basic chroot jail system that includes security and performance enhancements. Plus a new level of "user friendliness" enhancements dealing with deploying just a few jails or large jail environments consisting of 100's of jails. Qjail requires no knowledge of the jail command usage. It uses "nullfs" for read-only system binaries, sharing one copy of them with all the jails. Uses "mdconfig" to create sparse image jails. Sparse image jails provide a method to limit the total disk space a jail can consume, while only occupying the physical disk space of the sum size of the files in the image jail. Ability to assign ip address with their network device name, so aliases are auto created on jail start and auto removed on jail stop. Ability to create "ZONE"s of identical qjail systems, each with their own group of jails. Ability to designate a portion of the jail name as a group prefix so the command being executed will apply to only those jail names matching that prefix. WWW: http://sourceforge.net/projects/qjail/ http://qjail.sourceforge.net/ PR: ports/148777 Submitted by: Joe Barbish <joeb@a1poweruser.com> Approved by: rene (mentor)
2011-06-11 23:22:20 +02:00
@dirrm %%EXAMPLESDIR%%
Reference in a new issue Copy permalink