From owner-freebsd-questions@freebsd.org  Thu Dec  3 05:53:00 2015
Return-Path: <owner-freebsd-questions@freebsd.org>
Delivered-To: freebsd-questions@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id E5E34A3F9A7
 for <freebsd-questions@mailman.ysv.freebsd.org>;
 Thu,  3 Dec 2015 05:53:00 +0000 (UTC)
 (envelope-from alexmiroslav@gmail.com)
Received: from mail-wm0-x22c.google.com (mail-wm0-x22c.google.com
 [IPv6:2a00:1450:400c:c09::22c])
 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id 827731868
 for <freebsd-questions@freebsd.org>; Thu,  3 Dec 2015 05:53:00 +0000 (UTC)
 (envelope-from alexmiroslav@gmail.com)
Received: by wmww144 with SMTP id w144so6822944wmw.1
 for <freebsd-questions@freebsd.org>; Wed, 02 Dec 2015 21:52:59 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:in-reply-to:references:date:message-id:subject:from:to
 :content-type; bh=EtihOGtL7C71ftw6EnZRlXmmz44oD5huiE5N8plC1x8=;
 b=qkEca3t/Q3CA6/4G0+syszDo7HLn19LXDNYxzEWrUFf2GdSneDARNIl43XvKkuV8Kn
 US9XMvtQiaxLNPsQ17wrMkWgukozXLwvho+wT0EDToWDCeG5uNxx/zIxnoEESm4eDdcz
 /wPb+e+aUzAyYCOcYg2gNthhJXXJ1XHMSBjlsnseZZHQjA6c9Fxqaq9hqzWWvHQiPUZw
 y4S1qxknIJK7o7fzQ5iqZLTiWRMwz0k8uubuVzH9bIAJ4FZtKCbUsrDxq4tCQ9ipaYe3
 x8tbtTHJYGTrAu9eMEB4HsUOPjuSvC94oX2XxCPYu+NGEogQQPA4OSMBcnWk6y6G6IoV
 PipQ==
MIME-Version: 1.0
X-Received: by 10.195.11.233 with SMTP id el9mr8741814wjd.145.1449121979087;
 Wed, 02 Dec 2015 21:52:59 -0800 (PST)
Received: by 10.28.162.16 with HTTP; Wed, 2 Dec 2015 21:52:59 -0800 (PST)
In-Reply-To: <CACcSE1yQO8AjW9rpY+d2p1-ArPbO4qKV0zcaCMyRhYEWLOpQGA@mail.gmail.com>
References: <CACcSE1yQO8AjW9rpY+d2p1-ArPbO4qKV0zcaCMyRhYEWLOpQGA@mail.gmail.com>
Date: Wed, 2 Dec 2015 21:52:59 -0800
Message-ID: <CACcSE1yqeXqd=mLJ-=aJGr0hXcUEE0v3MeiAty6e4cgpWF7D8g@mail.gmail.com>
Subject: Re: best practice for locking down private jail?
From: Aleksandr Miroslav <alexmiroslav@gmail.com>
To: freebsd-questions@freebsd.org
Content-Type: text/plain; charset=UTF-8
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions/>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Dec 2015 05:53:01 -0000

On Wed, Dec 2, 2015 at 9:44 PM, Aleksandr Miroslav
<alexmiroslav@gmail.com> wrote:
> - from the example.org machine, outside the jail, i setup httpd to
> serve files only from
> /usr/jails/privatejail/usr/home/joeblow/audiofiles
[...]
> can I tell Apache to only serve up mp3 files of name
> lecture-num.mp3 or something like that?

Thinking about this some more. I think instead of having apache point
to the jail directly, I setup a cron job on the host that calls a
script that runs every 5 minutes or so, and copies only mp3 files of
some pattern-matched name to the host system, and then only that is
served up by apache. That would work better I think. It would have to
be a cron job on the host, I don't think I can have a script from
inside the private jail call something directly on the host.