I am planning on migrating my Ubuntu home server to FreeBSD. I will be running Samba, Plex, Syncthing and rclone.
Well, all those programs seem to be part of the ports collection so it shouldn't be too much bother to install them. Either by using the ports or binary packages I suppose. If its security you want though I'd recommend using the ports collection and building the software yourself. At the very least you'll be able to customize it (if applicable) and you'll know if it actually builds cleanly.
Fair warning though: FreeBSD is not Linux. That may sound obvious enough but I've seen many people try to apply their Linux habits onto FreeBSD only to often fail. Focus on achieving whatever goal you have, not on how you think it should be done.
So back to your question...
Is it worth setting up jails for such a simple home setup? Using ezjail makes the administrative overhead pretty simple, and I could restrict each application to it’s own jail, and also give each access to only the datasets it needs.
Depends on what you hope to gain by this. Do you trust your home network? If so then I guess you could simply skip the jails and run the processes it on your main OS. FreeBSD has plenty of native security measures to help you keep things under control.
sysctl kern.securelevel comes to mind as well as
security.bsd.see_other_uids and
security.bsd.unprivileged_read_msgbuf. See
/etc/sysctl.conf as well as
sysctl(8) for more information.
Or perhaps set up one jail for "external processes" and group the whole set in there. It will definitely harden your system a bit, assuming you're setting it up in the right way of course
Jails can definitely help, and using jails can even help you learn about this technology which is a good thing. However don't rely on software or features such as jails to keep you safe. It can help, but security isn't gained by simply installing or using something; it's gained by knowing what you're doing and properly setting up your system.
Sorry for all the clichés here but trust me when I say that it's based on past experience as well as your comment. Yes,
ezjail can make it easy, but what does that gain you if you don't know exactly what a jail does? Keep well in mind that a jail is still a process running on the same host using the same kernel. Breaking out of those isn't totally impossible.
How would I go about this?
Depends. If I want to keep these services secured I'd probably rely on one single jail and run them all in there. Just like I'd use a second jail to actually build the software so that I can be sure it actually builds and I'll have the whole setup separated. Then again, I even wouldn't rely on
ezjail but simply edit
/etc/jail.conf and set up my jail(s) manually. It's seriously easy, just be sure to check
jail(8) as well as
jail.conf(5).
Hope this can give you some ideas.
