Best practices for users in jails reddit / freebsd ---------------------------------------------------------------------- foxcub · 2022-08-20 16:26 What are the best practices for creating users in jails? No documentation or guide that I've seen talks about this. I realize that you can create the users in a jail in the same way as on the host, but are there any guidelines? E.g., is it a good idea to have usernames/uids match between the jail and the host? Surely it's a bad idea to do everything as a root in a jail, so I find it puzzling that there is no discussion of this. Also, perhaps unrelated, I know there are exec.system_user and exec.jail_user, but I can't find much documentation or any tutorials on how to use them. Any advice there? ---------------------------------------------------------------------- scipio_africanus123 · 2022-08-20 17:29 rehabilitate don't incarcerate ---------------------------------------------------------------------- foxcub · 2022-08-21 00:45 Does this have some deeper practical advice, or is it just a joke? ---------------------------------------------------------------------- scipio_africanus123 · 2022-08-21 03:29 joke ---------------------------------------------------------------------- okapi-a · 2022-08-23 16:57 Rather depends what you use your jails for. Most of mine run specific services and don't have human users. I tend to create users from the ansible playbook used to deploy each jail. Ansible is a good solution in general where you have too few users to justify something like LDAP because the syntax is OS independent but you get configuration control. From testing, jails seem to be sufficiently isolated so having a particular UID in one jail doesn't give you visibility of processes with that same UID in a different jail. \`ps\` as root on the host can include processes from jails and it could be useful to see accurate usernames. Avoiding UID reuse might protect you in the case of a kernel bug. If users have accounts across jails it can be useful to allocate consistent UIDs.