diff options
author | dannyboy <dannyboy@FreeBSD.org> | 2004-05-20 06:37:44 +0000 |
---|---|---|
committer | dannyboy <dannyboy@FreeBSD.org> | 2004-05-20 06:37:44 +0000 |
commit | 6e5d1af09ee4d06a454b4aaf655e1d04707e2872 (patch) | |
tree | 6201fe0a554355eba0daa33c8693654781514756 | |
parent | 45f0ba15479f1a485802e54e398ddc3196c04795 (diff) | |
download | FreeBSD-src-6e5d1af09ee4d06a454b4aaf655e1d04707e2872.zip FreeBSD-src-6e5d1af09ee4d06a454b4aaf655e1d04707e2872.tar.gz |
Typos and nits.
-rw-r--r-- | usr.sbin/jail/jail.8 | 38 |
1 files changed, 19 insertions, 19 deletions
diff --git a/usr.sbin/jail/jail.8 b/usr.sbin/jail/jail.8 index 96d99ae..21ff002 100644 --- a/usr.sbin/jail/jail.8 +++ b/usr.sbin/jail/jail.8 @@ -73,10 +73,10 @@ to create a "virtual system image" running a variety of daemons and services. In both cases, a fairly complete file system install of FreeBSD is required, so as to provide the necessary command line tools, daemons, -libraries, application configuration files, etc are available. +libraries, application configuration files, etc. However, for a virtual server configuration, a fair amount of additional work is required so as to configure the "boot" process. -This man page documents the configuration steps necessary to support +This manual page documents the configuration steps necessary to support either of these steps, although the configuration steps may be refined based on local requirements. .Pp @@ -85,7 +85,7 @@ Please see the man page for further details. .Sh EXAMPLES .Ss "Setting up a Jail Directory Tree" -This example shows how to setup a jail directory tree +This example shows how to set up a jail directory tree containing an entire .Fx distribution: @@ -110,8 +110,8 @@ See for information on how to use devfs rules to limit access to entries in the per-jail devfs. .Pp -In many cases this example would put far more stuff in the jail than is needed. -In the other extreme case a jail might contain only one single file: +In many cases this example would put far more in the jail than needed. +In the other extreme case a jail might contain only one file: the executable to be run in the jail. .Pp We recommend experimentation and caution that it is a lot easier to @@ -166,8 +166,8 @@ Other daemons will need to be manually configured\(emfor some this is possible through the .Xr rc.conf 5 -flags entries, for others it is necessary to modify per-application -configuration files, or to recompile the application. +flags entries; for others it is necessary to modify per-application +configuration files, or to recompile the applications. The following frequently deployed services must have their individual configuration files modified to limit the application to listening to a specific IP address: @@ -203,9 +203,9 @@ Attempting to serve NFS from the host environment may also cause confusion, and cannot be easily reconfigured to use only specific IPs, as some NFS services are hosted directly from the kernel. -Any third party network software running +Any third-party network software running in the host environment should also be checked and configured so that it -does not bind all IP addresses, which would result in those services also +does not bind all IP addresses, which would result in those services' also appearing to be offered by the jail environments. .Pp Once @@ -216,20 +216,20 @@ to a jail, and its sendmail is down, the mail is delivered to the host, etc.) .Ss Configuring the Jail .Pp -Start any jails for the first time without configuring the network +Start any jail for the first time without configuring the network interface so that you can clean it up a little and set up accounts. As with any machine (virtual or not) you will need to set a root password, time zone, etc. Some of these steps apply only if you intend to run a full virtual server -inside the jail; others apply for both constraining a particular application -or for a virtual server. +inside the jail; others apply both for constraining a particular application +or for running a virtual server. .Pp Start a shell in the jail: .Pp .Dl "jail /data/jail/192.168.11.100 testhostname 192.168.11.100 /bin/sh" .Pp -You will end up with a shell prompt, assuming no errors, within the jail. +Assuming no errors, you will end up with a shell prompt within the jail. You can now run .Pa /usr/sbin/sysinstall and do the post-install configuration to set various configuration options, @@ -303,7 +303,7 @@ jail, you may wish to consider setting the .Va security.jail.set_hostname_allowed sysctl variable to 0. Please see the management discussion later in this document as to why this -is a good idea. +may be a good idea. If you do decide to set this variable, it must be set before starting any jails, and once each boot. .Bd -literal -offset indent @@ -417,12 +417,12 @@ the .Dv IP_HDRINCL flag has been set on the socket. .It Va security.jail.getfsstatroot_only -This MIB entry determines whether or not processes within a jail is able +This MIB entry determines whether or not processes within a jail are able to see data for all mountpoints. -When set to 1 (default), +When set to 1 (default), the .Xr getfsstat 2 -system call only return (while called by jailed processes) the data for -the file system on which jail's root vnode is located. +system call returns only (when called by jailed processes) the data for +the file system on which the jail's root vnode is located. Note: this also has the effect of hiding other mounts inside a jail, such as .Pa /dev , @@ -529,7 +529,7 @@ address alias flag such that daemons listening on all IPs will not bind on that address, which would facilitate building a safe host environment such that host daemons do not impose on services offered from within jails. -Currently, the simplist answer is to minimize services +Currently, the simplest answer is to minimize services offered on the host, possibly limiting it to services offered from .Xr inetd 8 which is easily configurable. |