Date: Mon, 3 Jun 2019 12:19:17 +0200 From: Julien Cigar <julien@perdition.city> To: David Mehler <dave.mehler@gmail.com> Cc: freebsd-questions <freebsd-questions@freebsd.org> Subject: Re: to jail or not to jail Message-ID: <20190603101917.GA76784@home.lan> In-Reply-To: <CAPORhP4pbfCC96PXOeErJgswX_2dh%2BmXcBb1TrH6F0f5oN-wDw@mail.gmail.com> References: <CAPORhP4pbfCC96PXOeErJgswX_2dh%2BmXcBb1TrH6F0f5oN-wDw@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--d6Gm4EdcadzBjdND Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Jun 01, 2019 at 08:30:31PM -0400, David Mehler wrote: > Hello, Hello, >=20 > I've got a newly installed FreeBSD 12 vps. It's going to be running a > web server/php hosting multiple sites, with letsencrypt tls > certificates for each. It's also going to be running an email server, > postfix, dovecot, rspamd, mysql database backend, again with the same > letsencrypt tls certificates. Previously I've had all this on one > host. >=20 > What I'm wondering is if I should jail off these services, I've got a > zfs setup, still trying to wrap my head around that, and am wondering > should I run the database in one jail, the webserver/php in another > jail, and the email server in a third jail? If I do this how would I > get the tls certificates in to each jail, I'm looking for the maximum > automation. >=20 I would highly suggest to jail everything, not only for the added security, but also for maintainability. Suggestion: - Script everything with some CMS (I highly recommend SaltStack) - Use ZFS (and clones) and two datasets per jail: one for the things you deploy with your CMS and one for the "data" (=3D things generated by the installed applications within the jail), with some nullfs mounts from the HOST into the jails. It will facilitate the updates a lot. At the end the goal is to be able to zfs destroy tank/jails/your_jail and re-create it from scratch with one command. - With VIMAGE, tagged VLANs, some orchestration tool (SaltStack), and ZFS snapshots send/receive your can achieve nearly real-time migration. - Use HAProxy and SNI, and manage certs from there. At work we have an orchestration script which 1) generate Let's Encrypt certificates in somejail (certbot.lan) and if it succeed 2) rsync them on the HAProxy nodes Julien > Thanks. > Dave. > _______________________________________________ > freebsd-questions@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.o= rg" --=20 Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. --d6Gm4EdcadzBjdND Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE7vn2l0to0nV7EWolsrs3EKIEI8AFAlz09CIACgkQsrs3EKIE I8A8Zw//bHYzptCtc4ID/uqK+8O5PQOFI5EkR35vFpPtvkljp0r0EW3qYoF9nUrx qZSz0/mjEnjqYkGns4vvIgaEckE+SrNWRumO3XDSIHX201cinljzxYh8jPtuN5h2 ZQeNA5EMk1jzXmNeupJ1G0SBfqBT1dCM3DwB/vIiedOLy2IT1lMufqLMAF1t9JTd kHPWF9iI3p4eU/vHXCGF0cbHemSKUoxzK6owFIgOKs6Ebm85cVbYQkRiiEltjxVU edKK6YrukIen1+PImQdYA/zcSDNdSovPcFDWO9jVQsjH8XM23Hn7QpuT5m4ZBKwe +2vDzUQHK4vc7Z7OJ1oFT2daW4QeKF4ZYd32LULP2TslRC/DDmtJm7SrkMs258td kmie65ZtKp3mbGkODq21+KUFcHHOolC1mBzgBPegGeCF6m4WvWfrFbZCKOari1bI 1tNyxLyLVtrOuZKQXYc+yyaBau3FVPc4gDFnSgdnjSgTA4sHm48SPGz0J8M/Ac/5 RWB/84I1kOMuqALbTK2oI6p5e1I5ww0Wojg+nwWzNlXqwacTQZvJ9aTbNcl5r3jR VLI+ZFEGaavKYKHOLNVp3NcTVRnS0XMqYPYzN9HMy6apIGR6hiqIsDHYAU4Bt8ZJ Sq6kHWCqbAjnrRU8cOJDr7bTsVq39dnV9f6hwJmoXb4P1UkFBSc= =ciqi -----END PGP SIGNATURE----- --d6Gm4EdcadzBjdND--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20190603101917.GA76784>