Creating A Jail With VNC Server On FreeBSD
This article explains how you can run a VNC server from within a jail on FreeBSD.
Creating jail from source:
Create a directory where our jails will be stored:
# mkdir -p /home/jails
Or in /usr directory:
# mkdir -p /usr/jails
# mkdir /home/jails/testjail
Go to the /usr/src directory and check if you have the FreeBSD source code.
# cd /usr/src
# ls
You should see something like that:
COPYRIGHT contrib release LOCKS crypto rescue MAINTAINERS etc sbin Makefile games secure Makefile.inc1 gnu share ObsoleteFiles.inc include sys README kerberos5 tools UPDATING lib usr.bin bin libexec usr.sbin
If you have an empty directory or only a sys directory you must install the FreeBSD source code:
You can do this by running sysinstall or download the source code from cvs.
# sysinstall
Go to configuration then to distributions and select “src” and press ok. After that you should have all source code in the /usr/src/ directory. Then you should update your source code with the latest version from cvs. You must create a file “stable-supfile” in your home directory or somewhere else.
# vi ~/stable-supfile
And put into some lines like that:
# Your closer mirror of freebsd source code, for me is from Poland *default host=cvsup.pl.FreeBSD.org *default base=/usr *default prefix=/usr # for version 7.2 of FreeBSD you put RELENG_7_2 7.1 - RELENG_7_1 7.0 - RELENG_7_0 6.4 RELENG_6_4 *default release=cvs tag=RELENG_7_2 *default delete use-rel-suffix *default compress src-all
Next after you save the file you can update your FreeBSD source code with csup:
# csup /root/stable-supfile
After that you can compile your jail from source code:
# cd /usr/src
# make world DESTDIR=/home/jails/testjail
# make distribution DESTDIR=/home/jails/testjail
When you once compile World you can create new jails with two commands without compiling world once more:
# make installworld DESTDIR=/home/jails/otherjail
# make distribution DESTDIR=/home/jails/otherjail
When your jail is prepared you must do some changes in some configuration files.
# vi /home/jails/testjail/etc/rc.conf
And you put there:
sendmail_enable="NONE" sshd_enable="YES"
# cp /etc/resolv.conf /home/jails/testjail/etc/
# touch /home/jails/testjail/etc/fstab
Running jail for the first time:
To run jail you must mount devfs to jail:
# mount -t devfs devfs /home/jails/testjail/dev
Then you must configure an alias to your network interface. In my FreeBSD I have bge0 interface and alias I create like that:
# ifconfig bge0 alias 192.168.2.2
Running jail:
# jail /home/jails/testjail shell 192.168.2.2 /bin/tcsh
When you are in jail you can set up a root password:
# passwd
Then you must add one non-root account that will give you access to jail via ssh.
# adduser
To leve the jail you must use the exit command.
# exit
Your jail is nearly ready. You must add some lines to the /etc/rc.conf file and after that your jail will start when your serwer will be starting.
# alias to your network interface ifconfig_bge0_alias0="192.168.2.2" # line that enabling jails in freebsd jail_enable="yes" # list of your jails ex. “testjail otherjail httpjail sshjail” jail_list="testjail" jail_testjail_rootdir="/home/jails/testjail" jail_testjail_hostname="testjail" jail_testjail_ip="192.168.2.2" jail_testjail_exec_start="/bin/sh /etc/rc" jail_testjail_exec_stop="/bin/sh /etc/rc.shutdown" jail_testjail_devfs_enable="YES"
If you want to have the ports tree in jail and don’t want to replicate it we can mount /usr/ports/ directory to jail with one line in /etc/fstab file. Line like this:
/usr/ports /home/jails/testjail/usr/ports/ nullfs rw,auto 0 0
Starting and stopping jails without rebooting the system:
# /etc/rc.d/jail start testjail
# /etc/rc.d/jail stop testjail
If you want to get a list of your jails you can get it with this command:
# jls
Installing xorg and vnc in jail from packages:
# pkg_add –r xorg
# pkg_add –r vnc
To run vnc on user account you write:
$ vncserver
When you for the first time run vncserver you must set up a password for the vnc connection.
Default when you connect to vnc there will be run twm. You can change it by editing the ~/.vnc/xstartup file. You must change the last line from „twm &” to ex. „wmaker &” for WindowMaker environment.
To connect to the vnc jail you must write in vncviewer jail_ip_address and vnc port. Ex. 192.168.2.2:1
Some errors with vnc in jail: When you have a message of non recognizing colors you must edit /usr/local/bin/vncserwer file and change the line:
$cmd .= " -co /usr/X11R6/lib/X11/rgb";
When we have message
!!!!!!!!!!!!!!!!!!!!!!!!!!
no free display on jailname
You must edit /usr/local/bin/vncserver and change pack function to sockaddr_in in two lines in function CheckDisplayNumber:
[…]
pack ---> sockaddr_in(6000 +$n, &INADDR_ANY))) {
[…]
pack ---> sockaddr_in(5900 +$n, &INADDR_ANY))) {
[…]
Code should be like this:
sub CheckDisplayNumber
{
local ($n) = @_;
socket(S, $AF_INET, $SOCK_STREAM, 0) || die "$prog: socket failed: $!\n";
eval 'setsockopt(S, &SOL_SOCKET, &SO_REUSEADDR, pack("l", 1))';
if (!bind(S, sockaddr_in(6000 + $n, &INADDR_ANY))) {
close(S);
return 0;
}
close(S);
socket(S, $AF_INET, $SOCK_STREAM, 0) || die "$prog: socket failed: $!\n";
eval 'setsockopt(S, &SOL_SOCKET, &SO_REUSEADDR, pack("l", 1))';
if (!bind(S, sockaddr_in(5900 + $n, &INADDR_ANY))) {
close(S);
return 0;
}
close(S);
Port forwarding in IPWF for jails
If you want to forward some ports to the jail you must have compiled a FreeBSD kernel with some options enabled:
options IPFIREWALL options IPFIREWALL_DEFAULT_TO_ACCEPT options IPFIREWALL_VERBOSE options IPFIREWALL_FORWARD options IPDIVERT
Port forwarding rule:
ipfw add fwd ip_adres_jail,port_jail tcp from any to adresip_local port_local ex. ipfw add fwd 192.168.2.2,21 tcp from any to me 21 ipfw add fwd 192.168.2.2,21 tcp from any to 72.46.154.23 21
