Date: Thu, 20 Nov 2014 17:15:38 +0000 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: freebsd-questions@freebsd.org Subject: Re: 127.0.0.1 in a jail Message-ID: <546E21BA.703@infracaninophile.co.uk> In-Reply-To: <546E0EE8.3050102@qeng-ho.org> References: <546E08B3.9090906@yahoo.com> <546E0EE8.3050102@qeng-ho.org>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --jmWc1AA1e1FrGSgxun8v4Jqgcax3phejb Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 11/20/14 15:55, Arthur Chance wrote: > I don't think you can do anything to make 127.0.0.1 work as a target fo= r > connecting to - how is the common network stack to decide whether you'r= e > talking to the jail or the main box? It might be possible in VIMAGE > jails, but I have no experience of them. With a VIMAGE jail you certainly can create a loopback interface per jail and set that to use 127.0.0.1 or ::1 as its addresses with a VIMAGE jail. Unfortunately at the moment you need a custom kernel to add the VIMAGE functionality, and you need to avoid some of the various firewall implementations: with VIMAGE you'ld naturally run the firewall code from within the jail, rather than as something controlled by the host system. There are moves to make VIMAGE part of the default kernel config for 11.0-RELEASE, but that isn't expected until sometime next year and there are some pretty nasty crash-bugs which will have to be thoroughly squashed before it is enabled in a release. > You could always add an entry for localhost in the jail's /etc/hosts > that is the jail's address rather than 127.0.0.1. That's not going to > happen automatically though. You can do that -- but a lot of software will try and bind to localhost by one of the well known IP numbers rather than looking up 'localhost'. I've found it is generally possible to configure most software -- particularly server software -- either to bind to a specific IP address or else to use a unix domain socket, and that gives good results in jails. It is a bit of a faff though, and you don't get the intrinsic protection of binding some software to the loopback address if you have to bind it to the jail's IP. (One of the few common daemons you can't do that with is ntpd(8), but that's something it makes no sense at all to run in a jail, seeing as jails use exactly the same time-of-day as the host system) Cheers, Matthew --jmWc1AA1e1FrGSgxun8v4Jqgcax3phejb Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQJ8BAEBCgBmBQJUbiHAXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxOUYxNTRFQ0JGMTEyRTUwNTQ0RTNGMzAw MDUxM0YxMEUwQTlFNEU3AAoJEABRPxDgqeTnBYQP/2oc5a0Pr9pSIzyxRy45VjIx WFaYZEKv22aHlq/3VlFFdiMvY1Za026vKH9GUkCfm4Oi/qCHdqup8d7/ZJsbrgLg hNnsX/a6Ur0N4HN1acnRt1mh1GcXObDj+rQ4XCJjkU+MX5tAR6x7G50KPzeCCbgA nsblX6xF9Ry5zJrUZQ0nWOGNvrASNxshzj3uhxQKckAoTlZnyVMwSNFc8GbQWxhb 5GUOscQH3hMISEWMBjIZxWaKgru34eO2EpEjWNNVh4RwYeAbwHqdUAk6+N+lJqsE QZkqhBhdDKALqrXWvJ6ioWc+XgVR2bZcmbN+ZdkSllvQlzvcnLgowwLrCXEq9VI7 0ZjEDjV4qfz4PhWeb+FjHPWLjFi8QbpDKUcpPAVoinsJPlVGTUYgL9kiDJBoHYfY D7xc3HIYFmvEXQ50AY2B4YI+TlFq4iFiEJfXg9RnRgWviAyhlKMVGS4Ayy+g/+sO mpxcvmQvH/mRIetJhq5ymMhog64vYmkc70EatD5PdJM75h70llq6+SCZsbNIKK4b f55Pkf6waQ28/8v15SqmTO5lwe77pow65FPIbrCyNzd2VnpV2Jb/F8iBqyvvlIin m9oKM+T0DgQhIwm71dS0udBlKrow6P3yl7SgueVQqAaWFO6rhVNHzqSuJMakIfeU mG0TDZNEzTVZpbc/6tWv =oC3T -----END PGP SIGNATURE----- --jmWc1AA1e1FrGSgxun8v4Jqgcax3phejb--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?546E21BA.703>