Mundo FreeBSD

— Texto —

## Configuração do /etc/jail.conf -- Funcional, porém com muitas limitações 

jail1 {
        jid = 1;
#       ip4 = inherit;
        
        ip4.addr += "lo1|127.0.1.12/32";
        ip4.addr += "em0|192.168.1.90/24";

        host.hostname = "http10";
        mount.devfs;
        mount.procfs;
        mount.fdescfs;
        exec.start = "sh /etc/rc";
        exec.stop = "sh /etc/rc.shutdown jail";
        path = "/usr/local/etc/jails/hppd10";
        interface = em0;

		##### Resolvem problema para ping

        allow.raw_sockets;
        allow.socket_af;
        #allow.reserved_ports;
        
		

		### Resolvem problema para instalar Postgres

		sysvsem = "new";
  		sysvmsg = "new";
  		sysvshm = "new";
	
		###########################

        exec.clean;
        exec.system_user = "root";
        exec.jail_user = "root";
}





Configurações Recomendadas:


## /etc/devfs.rules (NOT .conf)

[bastille_vnet=13]
add include $devfsrules_hide_all
add include $devfsrules_unhide_basic
add include $devfsrules_unhide_login
add include $devfsrules_jail
add include $devfsrules_jail_vnet
add path 'bpf*' unhide



Lastly, you may want to consider these three sysctl values:

## ee /etc/sysctl.conf

net.link.bridge.pfil_bridge=0
net.link.bridge.pfil_onlyip=0
net.link.bridge.pfil_member=0







-- Novas opções, falta testar

# Common configs for all jails
path = "/jails/$name";
host.hostname = "$name";
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
exec.clean;
persist;
ip4 = inherit;
ip6 = inherit;
mount.devfs;
mount.fdescfs;
allow.mount;
allow.mount.devfs;
allow.mount.fdescfs;
allow.mount.nullfs;
allow.mount.tmpfs;
allow.mount.procfs;
allow.mount.zfs;
enforce_statfs=1;
children.max=100;
allow.socket_af;
allow.raw_sockets;
allow.chflags;
allow.sysvipc;
a {
devfs_ruleset="20";
}

/etc/devfs.rules

[a=20]
add include $devfsrules_hide_all  
add include $devfsrules_unhide_basic
add include $devfsrules_unhide_login
add path 'mixer*' unhide
add path 'dsp*' unhide
add path 'zfs*' unhide
-------------------------------------------------------------

####  Arquivo de configuração do pf.conf -- Funcional 

ext_if="em0"

set block-policy return
scrub in on $ext_if all fragment reassemble
set skip on lo

table <jails> persist
nat on $ext_if from <jails> to any -> ($ext_if:0)
rdr-anchor "rdr/*"                                        


# Redirecionar tráfego na porta 80 para a jail1
rdr pass on em0 proto tcp from any to 192.168.1.30 port 80 -> 192.168.1.99 port 80


block in all
pass out quick keep state
antispoof for $ext_if inet
pass in inet proto tcp from any to any port 22 flags S/SA modulate state

## Regras para liberar o acesso aos serviços das jails

pass in inet proto tcp from any to any port 80 flags S/SA modulate state # permite regras no porta 80 para todos os hosts
pass in inet proto tcp from any to 192.168.1.77 port 8080 flags S/SA modulate state # permite regras somente para um ip especifico


---------------

COnfiguração VNET 

www {
  devfs_ruleset = 13;
  enforce_statfs = 2;
  exec.clean;
  exec.consolelog = /var/log/bastille/www_console.log;
  exec.start = '/bin/sh /etc/rc';
  exec.stop = '/bin/sh /etc/rc.shutdown';
  host.hostname = www;
  mount.devfs;
  mount.fstab = /usr/local/bastille/jails/www/fstab;
  path = /usr/local/bastille/jails/www/root;
  securelevel = 2;

  vnet;
  vnet.interface = e0b_bastille0;
  exec.prestart += "jib addm bastille0 re0";
#  exec.prestart += "ifconfig e0a_bastille0 description \"vnet host interface for Bastille jail www\"";  # Linha original, desativada
  exec.prestart += "ifconfig e0a_bastille0 description \"POSTGRES-SERVER\"";    # Mudei a descricao da NIC
  exec.prestart += "ifconfig e0a_bastille0 10.0.0.1/24 up";     ## Acrescentei para adicionar IP na interface na inicializacao
  exec.poststop += "jib destroy bastille0";
}


#####################

pf.conf para o vtnet0

ext_if="vtnet0"        # Lembrar de alterar essa linha com o nome da sua interface   

nat on $ext_if from 10.0.0.0/24 to any -> ($ext_if)
rdr-anchor "rdr/*"

pass all


########################

Log primeiros testes com linux com bastille

# bastille bootstrap focal
fdescfs not enabled in /boot/loader.conf, Should I do that for you?  (N|y)
y
Persisting module: fdescfs
fdescfs_load:  -> YES
linprocfs not enabled in /boot/loader.conf, Should I do that for you?  (N|y)
y
Loading kernel module: linprocfs
Loaded linprocfs, id=27
Persisting module: linprocfs
linprocfs_load:  -> YES
linsysfs not enabled in /boot/loader.conf, Should I do that for you?  (N|y)
y
Loading kernel module: linsysfs
Loaded linsysfs, id=30
Persisting module: linsysfs
linsysfs_load:  -> YES
tmpfs not enabled in /boot/loader.conf, Should I do that for you?  (N|y)
y
Persisting module: tmpfs
tmpfs_load:  -> YES
Loading kernel module: linux
Loaded linux, id=31
Loading kernel module: linux64
Loaded linux64, id=32
linux_enable: NO -> YES
Debootstrap not found. Should it be installed? (N|y)
y


------------------ Samba em Jail -----------

1 - Acrescentar no arquivo jail.conf

		allow.mount.fdescfs;
	
		sysvsem = "new";
  		sysvmsg = "new";
  		sysvshm = "new"; 

2 - A versão funcional do backup foi samba413-4.13.17_5

3 - Lembrar de criar a jail com placa -V vnet:

4 - Comando para rolar o backup online (offline ainda não funcionou):

samba-tool domain backup online --targetdir=/root/backup --server=dc1.mundobsd.local -UAdministrator

5 - Restore, lembrar que não pode por o nome do mesmo servidor, por exemplo, meu DC tinha o nome de dc1.mundobsd.local, tive que mudar para dc2.mundobsd.local:

samba-tool domain backup restore --backup-file=/root/backup/samba-online-mundobsd.local-2023-07-13T08-56-54.154119.tar.bz2 --targetdir=/var/db/samba4 --newservername=dc2.mundobsd.local

6 - Após o restore do backup, mover ou copiar o arquivo smb.conf que está agora em /var/db/samba4/etc e com o nome smb.conf para /usr/local/etc com nome de smb4.conf:

cd /var/db/samba4/etc/
cp smb.conf /usr/local/etc/smb4.conf

7 - Mudar as permissões de pasta do samba4 para 0755:

chmod 0755 /var/db/samba4/

8 - Rodar o servidor samba e testar:

9 - Ainda falta testar mais, mas até aqui o servidor voltou normalmente