Run Java in a chrooted jail
Clash Royale CLAN TAG#URR8PPP
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
I'm on a CentOS 6.5 machine with Plesk Panel which I used to create a chrooted environment for a user who can access it via ssh.
I managed to let him use some basic non chroot standard command like chmod or ps.
NOW what I need to do to let him use java to run his own compiled jar inside his new shiny jail?
linux centos java chroot plesk
edited Mar 18 at 3:07
Rui F Ribeiro
42.1k1484142
asked Mar 5 '14 at 21:56
Leonardo GandiniLeonardo Gandini
84
add a comment |
I'm on a CentOS 6.5 machine with Plesk Panel which I used to create a chrooted environment for a user who can access it via ssh.
I managed to let him use some basic non chroot standard command like chmod or ps.
NOW what I need to do to let him use java to run his own compiled jar inside his new shiny jail?
linux centos java chroot plesk
edited Mar 18 at 3:07
Rui F Ribeiro
42.1k1484142
asked Mar 5 '14 at 21:56
Leonardo GandiniLeonardo Gandini
84
The complete Java runtime needs also to be located in the chroot path.
– user55518
Mar 5 '14 at 22:17
and it's possible or just crazy stuff to do? Can I also install a dedicated Java machine just inside the chroot dir or...?
– Leonardo Gandini
Mar 5 '14 at 22:53
it is possible and not easy.
– user55518
Mar 5 '14 at 22:56
add a comment |
I'm on a CentOS 6.5 machine with Plesk Panel which I used to create a chrooted environment for a user who can access it via ssh.
I managed to let him use some basic non chroot standard command like chmod or ps.
NOW what I need to do to let him use java to run his own compiled jar inside his new shiny jail?
linux centos java chroot plesk
edited Mar 18 at 3:07
Rui F Ribeiro
42.1k1484142
asked Mar 5 '14 at 21:56
Leonardo GandiniLeonardo Gandini
84
I'm on a CentOS 6.5 machine with Plesk Panel which I used to create a chrooted environment for a user who can access it via ssh.
I managed to let him use some basic non chroot standard command like chmod or ps.
NOW what I need to do to let him use java to run his own compiled jar inside his new shiny jail?
linux centos java chroot plesk
linux centos java chroot plesk
edited Mar 18 at 3:07
Rui F Ribeiro
42.1k1484142
asked Mar 5 '14 at 21:56
Leonardo GandiniLeonardo Gandini
84
edited Mar 18 at 3:07
Rui F Ribeiro
42.1k1484142
asked Mar 5 '14 at 21:56
Leonardo GandiniLeonardo Gandini
84
edited Mar 18 at 3:07
Rui F Ribeiro
42.1k1484142
edited Mar 18 at 3:07
Rui F Ribeiro
42.1k1484142
edited Mar 18 at 3:07
Rui F Ribeiro
42.1k1484142
42.1k1484142
asked Mar 5 '14 at 21:56
Leonardo GandiniLeonardo Gandini
84
asked Mar 5 '14 at 21:56
Leonardo GandiniLeonardo Gandini
84
asked Mar 5 '14 at 21:56
Leonardo GandiniLeonardo Gandini
84
84
The complete Java runtime needs also to be located in the chroot path.
– user55518
Mar 5 '14 at 22:17
and it's possible or just crazy stuff to do? Can I also install a dedicated Java machine just inside the chroot dir or...?
– Leonardo Gandini
Mar 5 '14 at 22:53
it is possible and not easy.
– user55518
Mar 5 '14 at 22:56
add a comment |
The complete Java runtime needs also to be located in the chroot path.
– user55518
Mar 5 '14 at 22:17
and it's possible or just crazy stuff to do? Can I also install a dedicated Java machine just inside the chroot dir or...?
– Leonardo Gandini
Mar 5 '14 at 22:53
it is possible and not easy.
– user55518
Mar 5 '14 at 22:56
The complete Java runtime needs also to be located in the chroot path.
– user55518
Mar 5 '14 at 22:17
The complete Java runtime needs also to be located in the chroot path.
– user55518
Mar 5 '14 at 22:17
and it's possible or just crazy stuff to do? Can I also install a dedicated Java machine just inside the chroot dir or...?
– Leonardo Gandini
Mar 5 '14 at 22:53
and it's possible or just crazy stuff to do? Can I also install a dedicated Java machine just inside the chroot dir or...?
– Leonardo Gandini
Mar 5 '14 at 22:53
it is possible and not easy.
– user55518
Mar 5 '14 at 22:56
it is possible and not easy.
– user55518
Mar 5 '14 at 22:56
add a comment |
1 Answer
1
active
oldest
votes
Do not use chroot(). Use OpenVZ. OpenVZ is chroot on steroids: Not only does OpenVZ give a container its own root directory, it also gives a container its own init() process, its own process list, its own IP, its own memory and disk space quota, etc.
- http://openvz.org/Quick_installation
- Once OpenVZ is installed, go to
/vz/template/cacheand download a CentOS template:wget http://ftp.openvz.org/template/precreated/centos-6-x86-devel.tar.gz - Now:
vzctl create 100 --ostemplate centos-6-x86-devel - Then:
vzctl set 100 --ipadd 192.168.1.99 --saveChange 192.168.1.99 to a static IP that will work on your network vzctl set 100 --nameserver 8.8.8.8 --saveUse one of Google's free DNS serversvzctl start 100vzctl enter 100- At the root prompt in the new container:
yum -y update - Install Java in the new container:
yum install java-1.6.0-openjdk-devel.i686 - Make a user and password/SSH key for the container so your buddy can play with Java:
adduser buddyfollowed bypasswd buddy(replace "buddy" with any name you wish to use here) - Make sure the container is running
sshdso he can SSH in to the container. - Make sure there is a way for him to get in to your computer.
The big gotcha here is that you will need to have full access to the machine in question and the computer will need to be on a network where you can assign a different IP for each container. Another gotcha is that the container will use about a gig of hard disk space -- more if your buddy makes a lot of files in the container. If the machine in question is a machine in a hosting environment, make sure the AUP you have allows you to run OpenVZ and other virtualization technologies (some hosting providers do not permit this).
answered Mar 6 '14 at 3:46
samiamsamiam
2,496813
This sounds like a solution ;) Many thanks!!
– Leonardo Gandini
Mar 6 '14 at 7:20
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f118316%2frun-java-in-a-chrooted-jail%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Do not use chroot(). Use OpenVZ. OpenVZ is chroot on steroids: Not only does OpenVZ give a container its own root directory, it also gives a container its own init() process, its own process list, its own IP, its own memory and disk space quota, etc.
- http://openvz.org/Quick_installation
- Once OpenVZ is installed, go to
/vz/template/cacheand download a CentOS template:wget http://ftp.openvz.org/template/precreated/centos-6-x86-devel.tar.gz - Now:
vzctl create 100 --ostemplate centos-6-x86-devel - Then:
vzctl set 100 --ipadd 192.168.1.99 --saveChange 192.168.1.99 to a static IP that will work on your network vzctl set 100 --nameserver 8.8.8.8 --saveUse one of Google's free DNS serversvzctl start 100vzctl enter 100- At the root prompt in the new container:
yum -y update - Install Java in the new container:
yum install java-1.6.0-openjdk-devel.i686 - Make a user and password/SSH key for the container so your buddy can play with Java:
adduser buddyfollowed bypasswd buddy(replace "buddy" with any name you wish to use here) - Make sure the container is running
sshdso he can SSH in to the container. - Make sure there is a way for him to get in to your computer.
The big gotcha here is that you will need to have full access to the machine in question and the computer will need to be on a network where you can assign a different IP for each container. Another gotcha is that the container will use about a gig of hard disk space -- more if your buddy makes a lot of files in the container. If the machine in question is a machine in a hosting environment, make sure the AUP you have allows you to run OpenVZ and other virtualization technologies (some hosting providers do not permit this).
answered Mar 6 '14 at 3:46
samiamsamiam
2,496813
This sounds like a solution ;) Many thanks!!
– Leonardo Gandini
Mar 6 '14 at 7:20
add a comment |
Do not use chroot(). Use OpenVZ. OpenVZ is chroot on steroids: Not only does OpenVZ give a container its own root directory, it also gives a container its own init() process, its own process list, its own IP, its own memory and disk space quota, etc.
- http://openvz.org/Quick_installation
- Once OpenVZ is installed, go to
/vz/template/cacheand download a CentOS template:wget http://ftp.openvz.org/template/precreated/centos-6-x86-devel.tar.gz - Now:
vzctl create 100 --ostemplate centos-6-x86-devel - Then:
vzctl set 100 --ipadd 192.168.1.99 --saveChange 192.168.1.99 to a static IP that will work on your network vzctl set 100 --nameserver 8.8.8.8 --saveUse one of Google's free DNS serversvzctl start 100vzctl enter 100- At the root prompt in the new container:
yum -y update - Install Java in the new container:
yum install java-1.6.0-openjdk-devel.i686 - Make a user and password/SSH key for the container so your buddy can play with Java:
adduser buddyfollowed bypasswd buddy(replace "buddy" with any name you wish to use here) - Make sure the container is running
sshdso he can SSH in to the container. - Make sure there is a way for him to get in to your computer.
The big gotcha here is that you will need to have full access to the machine in question and the computer will need to be on a network where you can assign a different IP for each container. Another gotcha is that the container will use about a gig of hard disk space -- more if your buddy makes a lot of files in the container. If the machine in question is a machine in a hosting environment, make sure the AUP you have allows you to run OpenVZ and other virtualization technologies (some hosting providers do not permit this).
answered Mar 6 '14 at 3:46
samiamsamiam
2,496813
This sounds like a solution ;) Many thanks!!
– Leonardo Gandini
Mar 6 '14 at 7:20
add a comment |
Do not use chroot(). Use OpenVZ. OpenVZ is chroot on steroids: Not only does OpenVZ give a container its own root directory, it also gives a container its own init() process, its own process list, its own IP, its own memory and disk space quota, etc.
- http://openvz.org/Quick_installation
- Once OpenVZ is installed, go to
/vz/template/cacheand download a CentOS template:wget http://ftp.openvz.org/template/precreated/centos-6-x86-devel.tar.gz - Now:
vzctl create 100 --ostemplate centos-6-x86-devel - Then:
vzctl set 100 --ipadd 192.168.1.99 --saveChange 192.168.1.99 to a static IP that will work on your network vzctl set 100 --nameserver 8.8.8.8 --saveUse one of Google's free DNS serversvzctl start 100vzctl enter 100- At the root prompt in the new container:
yum -y update - Install Java in the new container:
yum install java-1.6.0-openjdk-devel.i686 - Make a user and password/SSH key for the container so your buddy can play with Java:
adduser buddyfollowed bypasswd buddy(replace "buddy" with any name you wish to use here) - Make sure the container is running
sshdso he can SSH in to the container. - Make sure there is a way for him to get in to your computer.
The big gotcha here is that you will need to have full access to the machine in question and the computer will need to be on a network where you can assign a different IP for each container. Another gotcha is that the container will use about a gig of hard disk space -- more if your buddy makes a lot of files in the container. If the machine in question is a machine in a hosting environment, make sure the AUP you have allows you to run OpenVZ and other virtualization technologies (some hosting providers do not permit this).
answered Mar 6 '14 at 3:46
samiamsamiam
2,496813
Do not use chroot(). Use OpenVZ. OpenVZ is chroot on steroids: Not only does OpenVZ give a container its own root directory, it also gives a container its own init() process, its own process list, its own IP, its own memory and disk space quota, etc.
- http://openvz.org/Quick_installation
- Once OpenVZ is installed, go to
/vz/template/cacheand download a CentOS template:wget http://ftp.openvz.org/template/precreated/centos-6-x86-devel.tar.gz - Now:
vzctl create 100 --ostemplate centos-6-x86-devel - Then:
vzctl set 100 --ipadd 192.168.1.99 --saveChange 192.168.1.99 to a static IP that will work on your network vzctl set 100 --nameserver 8.8.8.8 --saveUse one of Google's free DNS serversvzctl start 100vzctl enter 100- At the root prompt in the new container:
yum -y update - Install Java in the new container:
yum install java-1.6.0-openjdk-devel.i686 - Make a user and password/SSH key for the container so your buddy can play with Java:
adduser buddyfollowed bypasswd buddy(replace "buddy" with any name you wish to use here) - Make sure the container is running
sshdso he can SSH in to the container. - Make sure there is a way for him to get in to your computer.
The big gotcha here is that you will need to have full access to the machine in question and the computer will need to be on a network where you can assign a different IP for each container. Another gotcha is that the container will use about a gig of hard disk space -- more if your buddy makes a lot of files in the container. If the machine in question is a machine in a hosting environment, make sure the AUP you have allows you to run OpenVZ and other virtualization technologies (some hosting providers do not permit this).
answered Mar 6 '14 at 3:46
samiamsamiam
2,496813
answered Mar 6 '14 at 3:46
samiamsamiam
2,496813
answered Mar 6 '14 at 3:46
samiamsamiam
2,496813
answered Mar 6 '14 at 3:46
samiamsamiam
2,496813
2,496813
This sounds like a solution ;) Many thanks!!
– Leonardo Gandini
Mar 6 '14 at 7:20
add a comment |
This sounds like a solution ;) Many thanks!!
– Leonardo Gandini
Mar 6 '14 at 7:20
This sounds like a solution ;) Many thanks!!
– Leonardo Gandini
Mar 6 '14 at 7:20
This sounds like a solution ;) Many thanks!!
– Leonardo Gandini
Mar 6 '14 at 7:20
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f118316%2frun-java-in-a-chrooted-jail%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
The complete Java runtime needs also to be located in the chroot path.
– user55518
Mar 5 '14 at 22:17
and it's possible or just crazy stuff to do? Can I also install a dedicated Java machine just inside the chroot dir or...?
– Leonardo Gandini
Mar 5 '14 at 22:53
it is possible and not easy.
– user55518
Mar 5 '14 at 22:56