Mirrors/BastilleBSD_bastille
1
0
Fork 1
mirror of https://github.com/BastilleBSD/bastille.git synced 2025-12-11 17:39:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

update README with ip6 example

Browse Source
This commit is contained in:
Christer Edwards
2020-02-16 14:23:05 -07:00
parent b1380b30e5
commit 863c3cacc5
1 changed files with 29 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
README.md
View File

@@ -1,11 +1,10 @@
Bastille: Automate Container Security Bastille
===================================== ========
[Bastille](https://bastillebsd.org/) is an open-source system for automating [Bastille](https://bastillebsd.org/) is an open-source system for automating
deployment and management of containerized applications on FreeBSD. deployment and management of containerized applications on FreeBSD.
Looking for [Bastille Templates](https://gitlab.com/BastilleBSD-Templates/)? Looking for [Bastille Templates](https://gitlab.com/BastilleBSD-Templates/)?
Installation Installation
============ ============
Bastille is available in the official FreeBSD ports tree. Bastille is available in the official FreeBSD ports tree.
@@ -21,7 +20,7 @@ portsnap fetch auto
make -C /usr/ports/sysutils/bastille install clean make -C /usr/ports/sysutils/bastille install clean
``` ```
**Git** **Git** (bleeding edge / unstable -- primarily for developers)
```shell ```shell
git clone https://github.com/BastilleBSD/bastille.git git clone https://github.com/BastilleBSD/bastille.git
cd bastille cd bastille
@@ -50,6 +49,7 @@ Available Commands:
cp cp(1) files from host to targeted container(s). cp cp(1) files from host to targeted container(s).
create Create a new thin or thick container. create Create a new thin or thick container.
destroy Destroy a stopped container or a bootstrapped release. destroy Destroy a stopped container or a bootstrapped release.
edit Edit container configuration files (advanced).
export Exports a container archive or image. export Exports a container archive or image.
help Help about any command help Help about any command
htop Interactive process viewer (requires htop). htop Interactive process viewer (requires htop).
@@ -298,26 +298,44 @@ IP at container creation.
- name - name
- release (bootstrapped) - release (bootstrapped)
- ip - ip (ip4 or ip6)
- interface (optional) - interface (optional)
**ip4**
```shell ```shell
ishmael ~ # bastille create folsom 12.0-RELEASE 10.17.89.10 ishmael ~ # bastille create folsom 12.1-RELEASE 10.17.89.10
Valid: (10.17.89.10). Valid: (10.17.89.10).
NAME: folsom. NAME: folsom.
IP: 10.17.89.10. IP: 10.17.89.10.
RELEASE: 12.0-RELEASE. RELEASE: 12.1-RELEASE.
syslogd_flags: -s -> -ss syslogd_flags: -s -> -ss
sendmail_enable: NO -> NONE sendmail_enable: NO -> NONE
cron_flags: -> -J 60 cron_flags: -> -J 60
``` ```
This command will create a 12.0-RELEASE container assigning the 10.17.89.10 ip This command will create a 12.1-RELEASE container assigning the 10.17.89.10 ip
address to the new system. address to the new system.
**ip6**
```shell
ishmael ~ # bastille create folsom 12.1-RELEASE fd35:f1fd:2cb6:6c5c::13
Valid: (fd35:f1fd:2cb6:6c5c::13).
NAME: folsom.
IP: fd35:f1fd:2cb6:6c5c::13
RELEASE: 12.1-RELEASE.
syslogd_flags: -s -> -ss
sendmail_enable: NO -> NONE
cron_flags: -> -J 60
```
This command will create a 12.1-RELEASE container assigning the
fd35:f1fd:2cb6:6c5c::13 ip address to the new system.
Optionally `bastille create [ -T | --thick ]` will create a container with a Optionally `bastille create [ -T | --thick ]` will create a container with a
private base. This is sometimes referred to as a "thick" container (whereas the private base. This is sometimes referred to as a "thick" container (whereas the
shared base container is a "thin"). shared base container is a "thin").
@@ -613,7 +631,7 @@ work as expected. This table outlines that order and those requirements:
| PLANNED | format | example | | PLANNED | format | example |
|---------|------------------|----------------------------------------------------------------| |---------|------------------|----------------------------------------------------------------|
| PF | pf rdr entry | rdr pass inet proto tcp from any to any port 80 -> 10.17.89.80 | | RDR | pf rdr entry | rdr pass inet proto tcp from any to any port 80 -> 10.17.89.80 |
| LOG | path | /var/log/nginx/access.log | | LOG | path | /var/log/nginx/access.log |
Note: SYSRC requires NO quotes or that quotes (`"`) be escaped. ie; `\"`) Note: SYSRC requires NO quotes or that quotes (`"`) be escaped. ie; `\"`)
@@ -752,7 +770,7 @@ ishmael ~ # bastille cp ALL /tmp/resolv.conf-cf etc/resolv.conf
/tmp/resolv.conf-cf -> /usr/local/bastille/jails/unbound0/root/etc/resolv.conf /tmp/resolv.conf-cf -> /usr/local/bastille/jails/unbound0/root/etc/resolv.conf
``` ```
bastille-rdr bastille rdr
------------ ------------
`bastille rdr` allows you to configure dynamic rdr rules for your containers `bastille rdr` allows you to configure dynamic rdr rules for your containers
@@ -761,7 +779,7 @@ for a private network and have enabled `rdr-anchor 'rdr/*'` in /etc/pf.conf
as described in the Networking section). as described in the Networking section).
```shell ```shell
# bastille rdr --help # bastille rdr help
Usage: bastille rdr TARGET [clear] | [list] | [tcp <host_port> <jail_port>] | [udp <host_port> <jail_port>] Usage: bastille rdr TARGET [clear] | [list] | [tcp <host_port> <jail_port>] | [udp <host_port> <jail_port>]
# bastille rdr dev1 tcp 2001 22 # bastille rdr dev1 tcp 2001 22
# bastille rdr dev1 list # bastille rdr dev1 list