Editing Jail Server Install (section)

=== create the jail template ===

cd /usr/ports/sysutils/jailutils
make install clean

Create an md device to hold the jail:
<pre>touch /mnt/data1/jail-template20g
mdconfig -a -t vnode -s 20g -f /mnt/data1/jail-template20g -u 0
newfs -O 1 /dev/md0
mkdir /mnt/data1/jail-DIR
mount /dev/md0 /mnt/data1/jail-DIR</pre>

Build world into the jail:
<pre>cd /usr/src
make world DESTDIR=/mnt/data1/jail-DIR; taskdone</pre>
~1hr

Make /etc into the jail, mount dev, copy in jkill:
<pre>cd etc
make distribution DESTDIR=/mnt/data1/jail-DIR
mount -t devfs devfs /mnt/data1/jail-DIR/dev
devfs -m /mnt/data1/jail-DIR/dev rule -s 3 applyset 
cd /mnt/data1/jail-DIR
ln -sf dev/null kernel
cp /usr/local/sbin/jkill /mnt/data1/jail-DIR/sbin</pre>

Enter into jail to do configuration:
 jail /mnt/data1/jail-DIR testhostname 192.168.11.100 /bin/sh
 csh

Create fstab:
<pre>touch /etc/fstab
echo 'network_interfaces=""\
hostname="newsystem"\
kern_securelevel_enable="NO"\
sendmail_enable="YES"\
sshd_enable="YES"' > /etc/rc.conf

echo "nameserver 69.55.225.225\
nameserver 69.55.230.3" >> /etc/resolv.conf</pre>

Edit crontab:
 vi /etc/crontab
remove the adjkerntz lines
comment out periodic’s and put this line above them:
 # IF YOU UNCOMMENT THESE, PLEASE ADJUST THEIR RUN TIME

 rm -rf /etc/periodic/daily/400.status-disks

check and remove any crap in /tmp

 vi /etc/periodic/security/100.chksetuid
replace: <tt>MP=`mount -t ufs | grep -v " nosuid" | awk '{ print $3 }' | sort`</tt><br>
with: <tt>MP='/'</tt> (use single quotes)

 mkdir -p /usr/compat/linux/dev

Add account for user. Output/response:
<pre>adduser

Username: user
Full name: user
Uid (Leave empty for default):
Login group [user]:
Login group is user. Invite user into other groups? []: wheel
Login class [default]:
Shell (sh csh tcsh nologin) [sh]:
Home directory [/home/user]:
Home directory permissions (Leave empty for default):
Use password-based authentication? [yes]:
Use an empty password? (yes/no) [no]:
Use a random password? (yes/no) [no]: y
Lock out the account after creation? [no]:
Username   : user
Password   : <random>
Full Name  : user
Uid        : 1001
Class      :
Groups     : user
Home       : /home/user
Home Mode  :
Shell      : /bin/sh
Locked     : no
OK? (yes/no): y
adduser: INFO: Successfully added (user) to the user database.
adduser: INFO: Password for (user) is: 901gmYjO
Add another user? (yes/no): n
Goodbye!</pre>

set TERM:
 vi /usr/home/user/.profile 
 TERM=vt100;     export TERM

Set time zone to PT:
 tzsetup

Reload aliases:
 newaliases 

Replace reboot/halt:
 rm /sbin/halt /sbin/reboot
 ln /sbin/jkill /sbin/halt
 ln /sbin/jkill /sbin/reboot

Redirect console output, comment out console and move to /var/log/messages:
 vi /etc/syslog.conf
 #*.err;kern.warning;auth.notice;mail.crit               /dev/console
 *.err;kern.warning;auth.notice;mail.crit                /var/log/messages 

 exit
 exit

Lib32 compat library:
 cd libexec
 chflags noschg ld-elf32.so.1
 chflags noschg ld-elf.so.1
 mv ld-elf32.so.1 ld-elf32.so.1-orig
 ln ld-elf.so.1 ld-elf32.so.1
 chflags schg ld-elf.so.1
 chflags schg ld-elf32.so.1

Replace traceroute:
 mv /mnt/data1/jail-DIR/usr/sbin/traceroute /mnt/data1/jail-DIR/usr/sbin/_traceroute
 echo '#\!/bin/sh\
 /usr/sbin/_traceroute -i bce0 $1' >> /mnt/data1/jail-DIR/usr/sbin/traceroute 
 chmod +x /mnt/data1/jail-DIR/usr/sbin/traceroute 

Modify 'bce0' to reflect whichever nic is public on this hardware.

Clean out ports before copying into the jail (~30mins):
 cd /usr/ports
 make -DNOCLEANDEPENDS clean 
 rm -fr /usr/ports/distfiles/*
 cp -r /usr/ports /mnt/data1/jail-DIR/usr 

 rm /mnt/data1/jail-DIR/root/.history

Umount the jail and dump it:
<pre>cd /
umount /mnt/data1/jail-DIR/dev
dump -0a -f /usr/local/jail/template/template /dev/md0
umount /dev/md0
rmdir /mnt/data1/jail-DIR
mdconfig -d -u 0</pre>