Help installing/configuring Warden - PC-BSD Forums

bforest · #1 02-23-2013, 12:04 AM

Hello All...

I have a FreeBSD server [sys info at bottom of msg] and would like to use Warden to manage Jails.

I have tried qjail and ezjail with limited success. Warden seems the most robust so I wanted to try that.

I want to use a different pool to store the jails so I created: /jpool/jails
My whole server is on ZFS: rpool(mirror) and jpool(raidz)

After installing Warden via ports I used the commands (as root):

Code:

# /usr/local/warden/scripts/init-warden.sh
# mkdir /usr/local/warden/worlds/defaultworld
# make buildworld installworld DESTDIR=/usr/local/warden/worlds/defaultworld
# pbreg set /PC-BSD/TheWarden/JailDir /jpool/jails
# warden menu

I am figuring there was more I needed to configure here, probably using pbreg, but ... hard to find docs on initial setup.

I created a jail named "apache" at 10.38.202.229 but found that I could not create any users or attempting to create users failed (including charlie root) I asked "warden delete" to remove the jail and tried a second time. I figure this is just some missing configuration. My system has no /PC-BSD directory for example.

I noticed the following after I deleted the jail the second time. The directory still exists and I cannot remove it. I get a busy error on proc.

Code:

root@dell0:/root # mount
 . . .
devfs on /jpool/jails/10.38.202.229/dev (devfs, local, multilabel)
procfs on /jpool/jails/10.38.202.229/proc (procfs, local)
devfs on /jpool/jails/10.38.202.229/dev (devfs, local, multilabel)
procfs on /jpool/jails/10.38.202.229/proc (procfs, local)
devfs on /jpool/jails/10.38.202.229/dev (devfs, local, multilabel)
procfs on /jpool/jails/10.38.202.229/proc (procfs, local)
devfs on /jpool/jails/10.38.202.229/dev (devfs, local, multilabel)
procfs on /jpool/jails/10.38.202.229/proc (procfs, local)
devfs on /jpool/jails/10.38.202.229/dev (devfs, local, multilabel)
procfs on /jpool/jails/10.38.202.229/proc (procfs, local)
devfs on /jpool/jails/10.38.202.229/dev (devfs, local, multilabel)
procfs on /jpool/jails/10.38.202.229/proc (procfs, local)
devfs on /jpool/jails/10.38.202.229/dev (devfs, local, multilabel)
procfs on /jpool/jails/10.38.202.229/proc (procfs, local)
devfs on /jpool/jails/10.38.202.229/dev (devfs, local, multilabel)
procfs on /jpool/jails/10.38.202.229/proc (procfs, local)
devfs on /jpool/jails/10.38.202.229/dev (devfs, local, multilabel)
procfs on /jpool/jails/10.38.202.229/proc (procfs, local)
devfs on /jpool/jails/10.38.202.229/dev (devfs, local, multilabel)
procfs on /jpool/jails/10.38.202.229/proc (procfs, local)
devfs on /jpool/jails/10.38.202.229/dev (devfs, local, multilabel)
procfs on /jpool/jails/10.38.202.229/proc (procfs, local)
devfs on /jpool/jails/10.38.202.229/dev (devfs, local, multilabel)
procfs on /jpool/jails/10.38.202.229/proc (procfs, local)


root@dell0:/root # rm -R /jpool/jails/10.38.202.229/proc
 . . . (a lot move above)
rm: /jpool/jails/10.38.202.229/proc/1/rlimit: Operation not supported
rm: /jpool/jails/10.38.202.229/proc/1/etype: Operation not supported
rm: /jpool/jails/10.38.202.229/proc/1/ctl: Operation not supported
rm: /jpool/jails/10.38.202.229/proc/1/cmdline: Operation not supported
rm: /jpool/jails/10.38.202.229/proc/1: Operation not supported
rm: /jpool/jails/10.38.202.229/proc/10/status: Operation not supported
rm: /jpool/jails/10.38.202.229/proc/10/rlimit: Operation not supported
rm: /jpool/jails/10.38.202.229/proc/10/etype: Operation not supported
rm: /jpool/jails/10.38.202.229/proc/10/ctl: Operation not supported
rm: /jpool/jails/10.38.202.229/proc/10/cmdline: Operation not supported
rm: /jpool/jails/10.38.202.229/proc/10: Operation not supported
rm: /jpool/jails/10.38.202.229/proc/0/status: Operation not supported
rm: /jpool/jails/10.38.202.229/proc/0/rlimit: Operation not supported
rm: /jpool/jails/10.38.202.229/proc/0/etype: Operation not supported
rm: /jpool/jails/10.38.202.229/proc/0/ctl: Operation not supported
rm: /jpool/jails/10.38.202.229/proc/0/cmdline: Operation not supported
rm: /jpool/jails/10.38.202.229/proc/0: Operation not supported
rm: /jpool/jails/10.38.202.229/proc/curproc: Operation not supported
rm: /jpool/jails/10.38.202.229/proc: Device busy

Code:

I believe I saw this error when trying to create a user:

cannot open /etc/rc: No such file or directory
jail: /bin/sh /etc/rc: failed

Code:

root@dell0:/root # uname -a
FreeBSD a2h-dell0 9.1-RELEASE FreeBSD 9.1-RELEASE #0 r243825: 
Tue Dec  4 09:23:10 UTC 2012     
root@farrell.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  amd64

Code:

root@dell0:/root # pkg_info | grep warden
warden-1.1.2_1      PC-BSD's Jail Management Utility

Code:

root@dell0:/root # zpool list
NAME       SIZE  ALLOC   FREE    CAP  DEDUP  HEALTH  ALTROOT
jpool     1.09T   909G   203G    81%  1.00x  ONLINE  -
rpool      136G  19.9G   116G    14%  1.00x  ONLINE  -

Code:

root@a2h-dell0:/root # pbreg get /PC-BSD/TheWarden/ProgDir
/usr/local/warden

root@dell0:/root # pbreg get /PC-BSD/TheWarden/WorldSrc
/usr/src

root@dell0:/root # pbreg get /PC-BSD/TheWarden/WorldDir
/usr/local/warden/worlds/defaultworld

root@dell0:/root # pbreg get /PC-BSD/TheWarden/NIC
bce1

root@dell0:/root # pbreg get /PC-BSD/TheWarden/TMPDIR
/usr/local/warden/tmp

root@dell0:/root # pbreg get /PC-BSD/TheWarden/JailDir
/jpool/jails

root@dell0:/root # pbreg
pbreg Version 1.0
 . . .

kmoore134 · #2 02-23-2013, 03:10 AM

That version of warden from ports is super-old, and you'll probably want
the newer stuff. Uninstall it and then grab the latest from here:

# svn co svn://svn.pcbsd.org/pcbsd/current/src-sh src-sh
# cd src-sh/libsh
# make install
# cd ../warden
# make install

After that is done, edit /usr/local/etc/warden.conf and then give it a
whirl.

bforest · #3 03-03-2013, 05:40 AM

Kris

Thank you for the info and instructions ...

I will attempt this installation this week.

Now that you mention the "warden" port is "behind" the latest... I was wondering when you think the regular FreeBSD port will be updated.

Thanks!

bforest · #4 03-07-2013, 07:14 PM

I attempted to perform this installation but could not get past the first command:

# svn co svn://svn.pcbsd.org/pcbsd/current/src-sh src-sh

I noticed that the CO stands for "check out". I don't think I want to check out because I have no intention to modify and check "back in". I also tried "svn cp ..." for copy but again... nothing. For either command the system just sits. When I run "top"; SVN is mostly idle.

Any suggestions?

I was able to: " ping svn.pcbsd.org " . Is there some way to verify I can make a valid connection to the svn server?

Code:

root@svr-dell0:/root # ping svn.pcbsd.org
PING isc.pcbsd.org (149.20.61.88): 56 data bytes
64 bytes from 149.20.61.88: icmp_seq=0 ttl=45 time=83.453 ms
64 bytes from 149.20.61.88: icmp_seq=1 ttl=45 time=84.022 ms
64 bytes from 149.20.61.88: icmp_seq=2 ttl=45 time=82.781 ms
64 bytes from 149.20.61.88: icmp_seq=3 ttl=45 time=82.836 ms
^C
--- isc.pcbsd.org ping statistics ---
5 packets transmitted, 4 packets received, 20.0% packet loss
round-trip min/avg/max/stddev = 82.781/83.273/84.022/0.507 ms

kmoore134 · #5 03-15-2013, 05:19 AM

Is this still an issue? The command is correct, I'm using it here with
no problems.

bforest · #6 03-18-2013, 08:55 PM

The only thing I can figure is that I am on a corporate network and trying to access this SVN server outside our network which is likely using port 3690.

Quote:

Unless you explicitly specify the port in the repository URL, it will be port 80 for HTTP, 443 for HTTPS, or 3690 for the SVN protocol

I will try changing the "svn://" to "http://" and see if it helps... I am not confident I can get my Corp. firewall guys to open that port for me.

Any other suggestions?

bforest · #7 03-20-2013, 03:52 PM

Sorry,

your procedure works fine.. It was a firewall issue. I was able to perform the first command at another location and tar up the folder for transport.

Thanks!!

bforest · #8 03-20-2013, 10:40 PM

I received the following error when attempting to use the downloaded "Warden" on my FreeBSD server.

Code:

root@dell0:/ # warden create 10.xxx.202.xxx testjail --src --ports --startauto --vanilla

Fetching jail environment. This may take a while...
Downloading 9.1-RELEASE/amd64/dist/base.txz ...
ERROR: Missing mirror list: /usr/local/share/pcbsd/conf/pcbsd-mirrors
/usr/local/share/warden/scripts/backend/createjail.sh: aria2c: not found
ERROR: Error while downloading the freebsd world.

root@dell0:/ # warden help

I will go look for these on a standard PCBSD9.1 workstation.

(but hope these will be included in the installation... or warden.conf in the future.)