Ulaş SAYGIN UlasSAYGINIM

How to jail a single process web server on FreeBSD 12.1

You may have found many great resources on how to set up jails on latest FreeBSD, however there is scant information on how to go about creating a barebones jail with nothing but the one process that you want to isolate.

I was curious if I could contain a statically compiled web server that I wrote while learning Rust all by itself in a jail instead of having a full userland.

Adobe Crash Fix XLNC

Instructions

Install needed adobe apps from adobe creative cloud.
Open Terminal.
Copy-paste the below command to your terminal and run it (enter password when asked).

When you want DHCP

sudo iocage set bpf=yes dhcp=on devfs_ruleset=5 JAILNAME

setup pkgs from iocage plugin type

https://www.justinsilver.com/random/fix-pkg-on-freenas-11-2/

Enable FreeBSD in /usr/local/etc/pkg/repos/FreeBSD.conf

To enable tun interfaces in iocage

Deploys FreeBSD on a Hetzner cloud server

Prerequisites:

A Hetzner Cloud API Token (Pass in via APIKEY)
jq
sshpass

Usage

Replace server_id variable with your hetzner server Id

FreeBSD Jail Permanent Port Forwarding

Configures jail to forward external ports to a different loopback port within a given jail.

vi /etc/ipfw.rules       # Add ipfw.rules from gist
chmod +x /etc/ipfw.rules # Enable script execution
crontab -e               # Add crontab.conf from gist

	package main

	import (
	"gorm.io/driver/sqlite"
	"gorm.io/gorm"
	)

	type job1 struct {
	ID int `gorm:"primaryKey"`
	UniqueField1 string

	# Flush all rules
	ipfw -q -f flush

	# Destroy ACLs
	ipfw -q table all destroy

	# Create SSH access ACL
	ipfw -q table SSHAccess create type addr
	ipfw -q table SSHAccess add 192.168.0.1 # SysAdm workstation

	% sysctl dev.pcm
	dev.pcm.1.bitperfect: 0
	dev.pcm.1.buffersize: 65536
	dev.pcm.1.rec.vchanformat: s16le:2.0
	dev.pcm.1.rec.vchanrate: 48000
	dev.pcm.1.rec.vchanmode: fixed
	dev.pcm.1.rec.vchans: 1
	dev.pcm.1.rec.autosrc: 2
	dev.pcm.1.rec.32bit: 24
	dev.pcm.1.%parent: hdaa0

	[Oct 24 06:55] <debdrup> dvl: an addendum to your post; you should avoid using allow_sysvipc and instead
	use the sysvmsg, sysvshm, and sysvsem properties (ie. set them to new).

	[Oct 24 06:56] <debdrup> with allow_sysvipc the SysV IPC is still shared with the host, whereas the new
	properties isolate SysV IPC to per-jail

	# dhcpd.conf
	# option definitions common to all supported networks...
	option subnet-mask 255.255.255.0;
	default-lease-time 600;
	max-lease-time 7200;

	subnet 192.168.20.0 netmask 255.255.255.0 {
	range 192.168.20.2 192.168.20.40;
	option domain-name-servers 192.168.20.1;
	option routers 192.168.20.1;