ubuntu 18.04 jailkit broken?

Discussion in 'General' started by nhybgtvfr, Aug 24, 2018.

  1. nhybgtvfr

    nhybgtvfr Active Member

    hi,

    not sure if this should be here, in the installation/configuration area, or in one of the Linux areas, but I found the problem through ispconfig, and it affects ssh-user creation In ispconfig, so i'll post it here, feel free to move it if it's more relevant elsewhere.

    I found an issue with ssh-users whilst attempting a test migration from some ubuntu 16.04 servers to ubuntu 18.04 servers, I didn't know if it was an issue with migration, or something else, so in an attempt to isolate the problem more, I've installed a few different servers now, some standalone, some multi-server, all following the perfect server tutorial for ubuntu 18.04 (apache) https://www.howtoforge.com/tutorial...l-pureftpd-bind-postfix-doveot-and-ispconfig/

    the jailkit service exits, immediately after starting, with logging showing 'no sockets specified in configfile /etc/jailkit/jk_socketd.ini on on commandline, nothing to do, exiting....'

    I've tried manually entering the config into the jksocketd.ini file

    Code:
    # example
    #[/home/testchroot/dev/log]
    #base = 1024
    #peak = 10240
    #interval = 2.0
    [/var/www/clients/client766/web1824/dev/log]
    base=512
    peak=2048
    interval=10
    
    and now jailkit will complain about no such file or directory /var/www/clients/client766/web1824/dev/log,
    then that no sockets are specified in /etc/jailkit/jk_socketd.ini and then exit

    if I manually create the folder /var/www/clients/client766/web1824/dev, and start jailkit, it'll start, and create the log socket.

    Code:
    ● jailkit.service - LSB: Start jk_socketd at boot time
       Loaded: loaded (/etc/init.d/jailkit; generated)
       Active: active (running) since Fri 2018-08-24 10:12:43 BST; 15s ago
         Docs: man:systemd-sysv-generator(8)
      Process: 28558 ExecStop=/etc/init.d/jailkit stop (code=exited, status=0/SUCCESS)
      Process: 28562 ExecStart=/etc/init.d/jailkit start (code=exited, status=0/SUCCESS)
        Tasks: 1 (limit: 2317)
       CGroup: /system.slice/jailkit.service
               └─28575 /usr/sbin/jk_socketd
    Aug 24 10:12:43 control systemd[1]: Stopped LSB: Start jk_socketd at boot time.
    Aug 24 10:12:43 control systemd[1]: Starting LSB: Start jk_socketd at boot time...
    Aug 24 10:12:43 control jk_socketd[28573]: version 2.19, listening on socket /var/www/clients/client766/web1824/dev/log
    Aug 24 10:12:43 control jailkit[28562]: Starting jailkit: jk_socketd done.
    Aug 24 10:12:43 control systemd[1]: Started LSB: Start jk_socketd at boot time.
    
    and it seems that the /web1824/bin,etc,usr folders do get created eventually (seems to take a very long time)
    but the /web1824/home/<user> folder never gets created, and the create ssh-user job is stuck in ispconfig's job queue (currently been about 16 hours)


    it all works fine on ubuntu 16.04 and 17.10, I've tested it on multiple servers, and it's absolutely fine up to and including 17.10, but every 18.04 install I've done presents exactly the same problem.
    which is strange as the jailkit install instructions in the tutorials for 17.10 and 18.04 are identical.

    I don't know if anyone else has the same problem, and maybe just not noticed it yet, there's no evident problem until actually attempting to create an ssh-user on an 18.04 server.
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    The jailkit service is not used on ISPConfig servers, so it does not matter for an ISPConfig setup if it starts. I just created a jailed SSH user in ISPConfig 3.1.13 on Ubuntu 18.04, the user and jail works fine here. The setup I use is the one that is described in the perfect server tutorials.
     
  3. till

    till Super Moderator Staff Member ISPConfig Developer

    Besides that, the jailkit service does not report any issues when I restart it here.
     
  4. ahrasis

    ahrasis Well-Known Member

    Jailkit is working fine in my built as well. My suggestion is that you redo your jailkit installation based on the new tutorial you mentioned, as you could have missed any of the step in there, and then update your ISPConfig afterwards.
     
  5. nhybgtvfr

    nhybgtvfr Active Member

    ok, I can confirm it is working ok on the one 18.04 server I have connected to the old ispconfig system. saw the same jailkit exited stuff in the syslog when no ssh-users were configured on that server and assumed it had the same problem.
    and the service starts ok once the ssh-user is setup on there.

    so the jailkit stuff isn't used as a service anyway. good to know, so all the warnings/errors on that part was a red herring then.

    no idea yet why it's not working on the new servers I've just setup. I didn't miss any steps in the setup. and the configuration files are identical to those on working servers.
    will retry re-installing it and updating as ahrasis suggests.

    is there a specific script I can run manually for creating the ssh-user as if triggered by the job queue rather than manually running server.sh? or does it call jk_init passing the required cli arguments?
     
  6. till

    till Super Moderator Staff Member ISPConfig Developer

    ISPConfig uses jk_init plus some other commands to set up the jail. You can find the detailed commands in the code of the ISPConfig jailkit plugin.
     
  7. Jesse Norell

    Jesse Norell Well-Known Member

  8. nhybgtvfr

    nhybgtvfr Active Member

    cheers Jesse.
    I may have missed a step installing the last server, as I said before, it is actually working on some 18.04 servers. just didn't realise it wasn't using jailkit as a service so thought those same socket complaints when no ssh-users are configured was a problem on them as well.

    I've wiped the old server now and re-installing. I've got a lot of additions to the tutorial i'm trying out as well, mailgraph, bindgraph, pflogsumm, munin, monit, ioncube loaders, multiple php versions, s3fs, changes to file limits, kernel changes for ec2 quotas etc.
    I know most of these have been used successfully with ispconfig3 already, I've had various bits of them running on some servers already myself, so don't expect any of them to be a problem, but I've not had all of them on one server, so I can't rule out on the them causing the problem, that said, it may well be something as simple as a problem in the jk_init.ini file.
    i just want to make sure I've got everything in order, and the install documented and working, and then I can script it in ansible or cloudformation.

    if I still have this problem after the re-install your script looks like it'll prove very useful to troubleshoot it. thanks.
     
  9. Jesse Norell

    Jesse Norell Well-Known Member

    Not just to troubleshoot, you should set up something like it too run as a cronjob, or the binaries and libraries in the jail will never be updated. Ie. security updates will not be carried from the main system to the jails without that.
     
    nhybgtvfr likes this.
  10. till

    till Super Moderator Staff Member ISPConfig Developer

    Just as a side note on that topic, I have the code of a jail updater here which I've developed together with a hosting company that uses ISPConfig, this updater will be integrated into ISPConfig 3.1.14.
     
    ahrasis and Jesse Norell like this.
  11. Jesse Norell

    Jesse Norell Well-Known Member

Share This Page