How do I setup operating system-level virtualization that allows me to partition my FreeBSD-based server system into several independent mini-systems called jails.? I’d like to set one jail for mail and another for web server via 2 public IP address.

Each jail under FreeBSD virtual environment runs on the host machine with its own files, processes, user and superuser accounts. From within a jailed process, the environment is almost indistinguishable from a real system. The easiest way to set, create and modify jails is using a framework called ezjail.

WARNING! You need to modify host server daemons to listen to only or a single private or public IP such as At least you need to modify sshd, syslogd and other services before you configure jails. Sample Setup : FreeBSD host server running v7.2 with : Mail server jail with : Web server jail with Step # 1: Update Your Host System Make sure you are running updated kernel and base system. Use cvsup command to install the latest kernel and base system. See detailed tutorial about upgrading FreeBSD operating system.

Step # 2: Install ezjail Type the following commands to install ezjail port which contains two scripts to easily create, manipulate and run FreeBSD jails.

cd /usr/ports/sysutils/ezjail

make install clean

ezjail Default File Locations /usr/jails/ : Default location to store base jail system template. /usr/jails/flavours/ : Customization for each jail can be done via flavours. For e.g. adding default /etc/resolv.conf file or updating existing /etc/make.conf can be done here. /usr/jails/basejail/ : Base jail will be exported and mounted as read only for each jail. This will save disk space. /usr/local/etc/rc.d/ : Stop / Start / Restart jails script. /usr/local/etc/ezjail.conf : Configuration file for ezjail script. contains settings that control the operation of the ezjail rc script. It is also read by the ezjail-admin utility to figure out where it should perform its actions. /usr/local/etc/ezjail/ : All your jail configuration files are stored here. Step # 2: Create Base Jail Template Type the following command to creates or updates ezjail’s environment (aka basejail) from source, enter:

ezjail-admin update -p -i


-p : Provide ports for jail. -i : Do not run make world. This will save time and it will use existing buildworld done in step # 1. If you do not have source in /usr/src and never run make buildword, than you can also install it from ftp servers, use ezjail-admin install command as follows:

ezjail-admin install

Step # 3: Create SMTPD Mail Server Jail Type the following command to create jail with IP address at /jails/ directory:

ezjail-admin create -r /jails/

Update SMTPD Jail Config File The default config file is located at /usr/local/etc/ezjail/smtpd_nixcraft_net_in. Open this file using vi text editor:

vi /usr/local/etc/ezjail/smtpd_nixcraft_net_in

Set hostname and multiple IP address as required:

export jail_smtpd_nixcraft_net_in_hostname=“” export jail_smtpd_nixcraft_net_in_ip=“,"Save and close the file.

Step # 4: Turn On jail Service Type the following command:

echo ’ezjail_enable=“YES”’ » /etc/rc.conf

How do I start all Jails?

/usr/local/etc/rc.d/ start

How do I stop all Jails?

/usr/local/etc/rc.d/ stop

How do I restart all Jails?

/usr/local/etc/rc.d/ restart

You can also start / stop / restart particular jail using the following syntax:

/usr/local/etc/rc.d/ {start/stop/restart} jail-name

/usr/local/etc/rc.d/ start httpd

/usr/local/etc/rc.d/ stop

How Do I List All Jails? Use jls command to lists all jails:


To display more verbose information including cpusets, jail state, multi-IP, etc. enter:

jls -v

How Do I Login To My Jail From The Host Itself? Use jexec command as follows to attach a console to jail:

jexec jid csh

jid can be obtained using jls command. Connect to jail called with jid # 2:

jexec 2 csh

Now, you can install any software and do work with jails. Update your /etc/resolv.conf file:

vi /etc/resolv.conf

Install bash shell, enter:

pkg_add -r -v bash

Install Apache 2.2 server:

cd /usr/ports/www/apache22

make install clean

How Do I Login Remotely (Directly) To Jail? First, login using jexec command. Add the following line to jail /etc/rc.conf:

echo ‘sshd_enable=“YES”’ » /etc/rc.conf

Open sshd_config file and update listen parameter to bind to jail IP only. Start OpenSSH server inside the jail:

/etc/rc.d/sshd start

sockstat -4

How Do I Upgrade FreeBSD Jail? Simply run the following command:

/usr/local/etc/rc.d/ stop

ezjail-admin update -p -i

/usr/local/etc/rc.d/ start

How Do I Upgrade Only Ports Tree? No need to stop jails, just run the following to update ports tree for all jails:

ezjail-admin update -P

Jail Log Files The default jail console file is located at /var/log directory. For e.g. view log file for jail. enter:

tail -f jail_smtpd_nixcraft_net_in_console.log

grep ’error’ jail_smtpd_nixcraft_net_in_console.log

How Do I Add Additional Jails? Create httpd jail, enter:

ezjail-admin create -r /jails/

vi /usr/local/etc/ezjail/httpd_nixcraft_net_in

/usr/local/etc/rc.d/ start

jls -v

jexec id csh

How Do I Backup Jails? Use tar, rsync or dump command to backup jail to other server or tape device. For e.g. tar command to backup to tape:

tar -zcvf /dev/sa0 /jails/

You can also use dump command to backup all jails stored on /jails partition:

/sbin/dump -0uLf /dev/sa0 /jails/

Later just dump incremental updates:

/sbin/dump -1uLf /dev/sa0 /jails/

Recommend Readings: FreeBSD Jail chapter from the official FreeBSD handbook. man pages jexec, jls, jail, dump, restore