現実問題としてのバージョン固定化
管理の簡単さやセキュリティの面などいくつかの側面から、
しかし、
つまり、
複数のバージョンのユーザランドを混在させる
こうした場合にはいくつか対処方法がありますが、
アプリケーションによっては特定のバージョンでないといろいろ都合が悪いとか、
この方法はXenやKVM、
Jailってなに
Jailは最初にFreeBSDに実装された区画化技術の1つで、
UNIX系のオペレーティングシステムは基本的にスーパーユーザ
Jailはこれを可能にする技術で、
この機能を利用すれば、
9.3-RELEASEのJailを作ってみる
9.
# mkdir /path/to/j9 # cd /path/to/j9/ # fetch ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/9.3-RELEASE/base.txz # tar zxpf base.txz # rm base.tgz
base.
# tree -L 1 . ├── COPYRIGHT ├── bin ├── boot ├── dev ├── etc ├── lib ├── libexec ├── media ├── mnt ├── proc ├── rescue ├── root ├── sbin ├── sys -> usr/src/sys ├── tmp ├── usr └── var 15 directories, 2 files #
ここでは/Users/
j9 {
jid = 9;
name = j9;
path =/Users/daichi/j9;
ip4.addr = 192.168.1.252;
host.hostname = jail9.ongs.co.jp;
allow.raw_sockets;
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
interface = bge0;
mount.devfs;
}意味は書いてあるとおりですが、
- jid：JailのID番号
- name：Jailの名前
- ip4.
addr：Jailに割り当てるIPv4アドレス - host.
hostname：Jailに割り当てるホスト名 - allow.
raw_ sockets：ping(8)が通るようにする - exec.
start：起動時の処理 - exec.
stop：終了時の処理 - interface：割り当てるホスト側のNIC
- mount.
dev. fs：/dev/を生やす
いろいろな設定ができます。このあたりの設定はjail.
Jailを作成したら次のようにコマンドを実行して環境を起動します。
# service jail start j9 Starting jails: j9. #
Jail環境はjls(8)コマンドで表示させることができます。ここでは今作成したj9というJail以外にもj1という環境が動作していることがわかります。
# jls JID IP Address Hostname Path 1 192.168.1.251 jail1.ongs.co.jp /Users/daichi/j1 9 192.168.1.252 jail9.ongs.co.jp /Users/daichi/j9 # jls -v JID Hostname Path Name State CPUSetID IP Address(es) 1 jail1.ongs.co.jp /Users/daichi/j1 j1 ACTIVE 2 192.168.1.251 9 jail9.ongs.co.jp /Users/daichi/j9 j9 ACTIVE 3 192.168.1.252 #
Jailの中へダイブ
起動したJail環境へダイブするにはjexec(8)コマンドを使う方法が簡単です。次のようにJail名を指定して、
# jexec j9 /bin/sh ← ホストで実行 # ifconfig ← ここはもうJail9の中 bge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=c019b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,VLAN_HWTSO,LINKSTATE> ether fc:aa:14:a2:25:4a ↓ すでにIPも設定されている inet 192.168.1.252 netmask 0xffffffff broadcast 192.168.1.252 media: Ethernet autoselect (1000baseT <full-duplex>) status: active bge1: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=c019b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,VLAN_HWTSO,LINKSTATE> ether fc:aa:14:a2:25:4b media: Ethernet autoselect lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384 options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6> #
uname(1)を実行してみましょう。9.
# uname -a FreeBSD jail9.ongs.co.jp 10.1-RELEASE-p9 FreeBSD 10.1-RELEASE-p9 #0: Tue Apr 7 01:09:46 UTC 2015 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64 #
たとえばユーザランドのファイルを見てみると、
# head -30 /COPYRIGHT # $FreeBSD: releng/9.3/COPYRIGHT 267655 2014-06-20 00:13:56Z gjb $ # @(#)COPYRIGHT 8.2 (Berkeley) 3/21/94 The compilation of software known as FreeBSD is distributed under the following terms: Copyright (c) 1992-2014 The FreeBSD Project. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \`\`AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. The 4.4BSD and 4.4BSD-Lite software is distributed under the following #
Jail環境を微調整
この環境は配布物を展開しただけなので、
まず、
# date Mon May 11 10:48:54 UTC 2015 # tzsetup Asia/Tokyo ← タイムゾーンをJSTへ設定 # date Mon May 11 19:49:21 JST 2015 #
FreeBSDがcron(8)経由で定期的に実施している処理は、
# /etc/crontab - root's crontab for FreeBSD
#
# $FreeBSD: releng/9.3/etc/crontab 194170 2009-06-14 06:37:19Z brian $
#
SHELL=/bin/sh
PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin
#
#minute hour mday month wday who command
#
#*/5 * * * * root /usr/libexec/atrun
#
# Save some entropy so that /dev/random can re-seed on boot.
#*/11 * * * * operator /usr/libexec/save-entropy
#
# Rotate log files every hour, if necessary.
#0 * * * * root newsyslog
#
# Perform daily/weekly/monthly maintenance.
#1 3 * * * root periodic daily
#15 4 * * 6 root periodic weekly
#30 5 1 * * root periodic monthly
#
# Adjust the time zone if the CMOS clock keeps local time, as opposed to
# UTC time. See adjkerntz(8) for details.
#1,31 0-5 * * * root adjkerntz -a# service cron restart Stopping cron. Waiting for PIDS: 4966. Starting cron. #
最終的にはssh(1)でログインして利用する方が便利ですので、
# adduser Username: daichi Full name: Daichi GOTO Uid (Leave empty for default): Login group [daichi]: Login group is daichi. Invite daichi into other groups? []: Login class [default]: Shell (sh csh tcsh nologin) [sh]: Home directory [/home/daichi]: Home directory permissions (Leave empty for default): Use password-based authentication? [yes]: Use an empty password? (yes/no) [no]: Use a random password? (yes/no) [no]: Enter password: Enter password again: Lock out the account after creation? [no]: Username : daichi Password : ***** Full Name : Daichi GOTO Uid : 1001 Class : Groups : daichi Home : /home/daichi Home Mode : Shell : /bin/sh Locked : no OK? (yes/no): yes adduser: INFO: Successfully added (daichi) to the user database. Add another user? (yes/no): no Goodbye! #
DNSも使えるようにする必要があるので、
nameserver 8.8.8.8# dig gihyo.jp ; <<>> DiG 9.9.5 <<>> gihyo.jp ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31468 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;gihyo.jp. IN A ;; ANSWER SECTION: gihyo.jp. 9628 IN A 49.212.34.191 ;; Query time: 9 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Mon May 11 19:58:30 JST 2015 ;; MSG SIZE rcvd: 53 #
sshdを有効にする設定を/etc/
sshd_enable="YES"# service sshd start Generating RSA1 host key. 2048 81:c1:8e:3e:e7:c3:67:d9:48:1b:18:32:75:7e:68:4d root@jail9.ongs.co.jp (RSA1) Generating RSA host key. 2048 da:fe:8a:54:29:6e:f4:bd:14:6a:1e:49:35:35:56:0a root@jail9.ongs.co.jp (RSA) Generating DSA host key. 1024 71:37:48:5b:09:ee:37:1c:d6:38:11:b6:f2:63:d9:35 root@jail9.ongs.co.jp (DSA) Generating ECDSA host key. 256 dd:e3:3c:17:00:33:25:0f:41:ca:7b:86:fc:67:20:1d root@jail9.ongs.co.jp (ECDSA) Generating ED25519 host key. 256 d6:1d:c8:53:7e:98:84:08:60:df:ef:b6:4f:52:6b:67 root@jail9.ongs.co.jp (ED25519) Performing sanity check on sshd configuration. Starting sshd. #
Jail環境はホストとも別のJailともプロセス空間が隔離されているので、
# ps auxwwd USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND root 4907 0.0 0.0 12080 1828 ?? SsJ 7:32PM 0:00.02 /usr/sbin/syslogd -s root 4961 0.0 0.1 20336 4464 ?? SsJ 7:32PM 0:00.06 sendmail: accepting connections (sendmail) root 6640 0.0 0.0 14188 1816 ?? IsJ 7:52PM 0:00.00 /usr/sbin/cron -s root 7461 0.0 0.1 49276 5664 ?? IsJ 8:01PM 0:00.00 /usr/sbin/sshd root 5890 0.0 0.0 14544 2336 2 SJ 7:43PM 0:00.15 /bin/sh root 7564 0.0 0.0 16300 1816 2 R+J 8:03PM 0:00.00 - ps auxwwd #
ホストやほかのホストからsshでログイン
ちなみにホストではbge0に対して複数のIPアドレスが割り当てられているように見えます。Jail環境はホストと同じように、
% ifconfig bge0 bge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=c019b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,VLAN_HWTSO,LINKSTATE> ether fc:aa:14:a2:25:4a inet 192.168.1.101 netmask 0xffffff00 broadcast 192.168.1.255 inet 192.168.1.251 netmask 0xffffffff broadcast 192.168.1.251 inet 192.168.1.252 netmask 0xffffffff broadcast 192.168.1.252 nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL> media: Ethernet autoselect (1000baseT <full-duplex>) status: active %
ログインすると次のようになります。
% ssh daichi@192.168.1.252 The authenticity of host '192.168.1.252 (192.168.1.252)' can't be established. ECDSA key fingerprint is dd:e3:3c:17:00:33:25:0f:41:ca:7b:86:fc:67:20:1d. No matching host key fingerprint found in DNS. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.1.252' (ECDSA) to the list of known hosts. Password for daichi@jail9.ongs.co.jp: Last login: Mon May 11 20:17:29 2015 from 192.168.1.252 FreeBSD ?.?.? (UNKNOWN) Welcome to FreeBSD! Before seeking technical support, please use the following resources: o Security advisories and updated errata information for all releases are at http://www.FreeBSD.org/releases/ - always consult the ERRATA section for your release first as it's updated frequently. o The Handbook and FAQ documents are at http://www.FreeBSD.org/ and, along with the mailing lists, can be searched by going to http://www.FreeBSD.org/search/. If the doc package has been installed (or fetched via pkg_add -r lang-freebsd-doc, where lang is the 2-letter language code, e.g. en), they are also available formatted in /usr/local/share/doc/freebsd. If you still have a question or problem, please take the output of \`uname -a', along with any relevant error messages, and email it as a question to the questions@FreeBSD.org mailing list. If you are unfamiliar with FreeBSD's directory layout, please refer to the hier(7) manual page. If you are not familiar with manual pages, type \`man man'. Edit /etc/motd to change this login announcement. $
バージョン番号が不確定なのが嫌ということであれば、
とっても簡単、Jailを活用しよう
慣れてくると、
とくに10系からはJailの扱いが簡単になっていますので、