Created jail with mismatched versions using bsdinstall.

X

xsouku04

Recently after an upgraded from freebsd 14.3 to 14.4 we got not working ssh sever.
When we started the ssh server we got.

Starting sshd.
/usr/libexec/sshd-auth does not exist or is not executable
/etc/rc.d/sshd: WARNING: failed to start sshd done.

The file /usr/libexec/sshd-auth is present in the 14.4 freebsd version, not in the previous versions.

It looks no one on the internet expect this one Chinese person got the same problem.

[閒聊] FreeBSD 14.4 update p6 sshd 會不見

update 24 Jun 2026 : 今天我升另一台 FreeBSD 14.4 到 p6 就沒問題,看起來有修護? update 27 Jun 2026 : 今天 FreeBSD 14.4 到 p6 又 sshd 消失了 freebsd-update fetch & install 後,版本為 freebsd 14.4 p6
www.ptt.cc

It looks like we have version mismatch inside the jail.

freebsd-version -ru
14.4-RELEASE-p5
14.3-RELEASE


How did it happen ?

Unlike most jail users, for creating jail we use
bsdinstall jail rootfs


And it downloads the newest freebsd version to

/usr/freebsd-dist/base.txz
/usr/freebsd-dist/MANIFES


But if the files are present, it does not check them and does not download them again, but it expects it is the newest version.
Which may not be true if you used the command while ago.
So you create a jail with version mismatch.

I have fixed my jail create script called jcreate, so now it is checking the version of /usr/freebsd-dist/base.txz .
And offers to clear the cache so the new version is downloaded.

Hope it helps someone.

Bash: 
#! /bin/sh

jailName="$1"

if [ -z "${jailName}" ];
then
 echo " missing jail name "
 exit
fi

yesno() {
  while :; do
    printf "%s [y/n]: " "$1"
    read ans
    case "$ans" in y|Y) return 0 ;; n|N) return 1 ;; *) echo "y or n only" ;; esac
  done
}


mkdir -p /jails/$jailName

if zfs list zroot/jails/$jailName; then
  echo " Dataset $jailName already exists !"
  exit
else
 zfs create -o mountpoint=/jails/$jailName zroot/jails/$jailName
 # zfs set recordsize=8K zroot/jails/$jailName
 cd  /jails/$jailName

 echo "In file /usr/freebsd-dist/base.txz is already downloaded version"
 echo
 tar -xOf /usr/freebsd-dist/base.txz ./bin/freebsd-version | sed -n 's/.*USERLAND_VERSION="\([^"]*\)".*/\1/p'
 echo

 echo "The newest versions are:"
 fetch -qo - https://download.freebsd.org/releases/amd64 | grep -Eo '[0-9]+\.[0-9]+-RELEASE' | sort -Vu
 echo
 echo "I must always install the newest available version when creating a jail or you get in trouble."
 echo "You would get jail with version mismatch as bsdinstall is expecting the newest version"
 echo "in the directory /usr/freebsd-dist/ and it does not check it."
 echo
if yesno "Should I delete /usr/freebsd-dist/base.txz, so bsdinstall downloads newest version? [y/n]?"; then
  rm /usr/freebsd-dist/base.txz
  rm /usr/freebsd-dist/MANIFEST
fi


 #  it creates the directiory rootfs on on its own
 bsdinstall jail rootfs
 datum=`date "+%Y-%m-%d %H:%M:%S"`
 printf "$jailName{\n\$note = \"Created $datum\";\n\$ip = \"192.168.144.XXX/24\";\n}">/jails/$jailName/c.conf

 echo "Doing update patches"

 freebsd-update -b /jails/$jailName/rootfs fetch
 freebsd-update -b /jails/$jailName/rootfs install

 echo "Do not forget to change ip adress in /jails/$jailName/c.conf"
 echo "Remember to setup firewall."
 echo "Install apps for example by \"pkg install screen vim mc\" inside."
fi
 
SirDice said:
A jail doesn't have a kernel, it runs on the host's kernel.
Click to expand...
You are right that it is not proof of the versions mismatch.
However look at the following:

root@hokuspokus4:/ # freebsd-version
14.3-RELEASE
root@hokuspokus4:/ # freebsd-update fetch
src component not installed, skipped
Looking up update.FreeBSD.org mirrors... 3 mirrors found.
Fetching metadata signature for 14.4-RELEASE from update1.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.
Preparing to download files... done.
The following files will be added as part of updating to
14.4-RELEASE-p7:


Why doe freebsd-update fetch want to upgrade to 14.4-RELEASE ? I believe it should only apply patches to the 14.3-RELEASE.
 
I see the freebsd-update fetch inside a jail does not work correctly if the version of jail and the physical computer differs.
And in the case physical machine has got a higher version applies the wrong set of patches as it reads the version of kernel instead of userland.
Much better would be if freebsd-update would detect the situation it is not able to handle and refuse to proceed.

As coming from Linux doing upgrade inside a container is normal way how to proceed.

So the best way is to do it from outside the jail using -j jailname parameter ?
 
So the takeaway from this is?
Make sure you update /usr/FreeBSD-dist/ manually when updating a JAIL HOST if you create jails with bsdinstall.
 
Phishfry said:
So the takeaway from this is?
Make sure you update /usr/FreeBSD-dist/ manually when updating a JAIL HOST if you create jails with bsdinstall.
Click to expand...
No. I was wrong. The main take away is not to do upgrade from inside a jail, or you can end up with unconsistent system.

If you you use bsdinstall, it is good practice to delete the content /usr/freebsd-dist/ so you do not install older version. So you can skip the upgrade steps. But it was not the main cause of my troubles. The main trouble was, that I was doing upgrade from inside the jail which makes a mess. It was mixing older version with new patches.

The tricky thing was in my case, that the update from inside used to work when the jail and physical server had the same version. So I learned to do it. It stopped working after I upgraded the physical server and made a mess from a jail instead. Applying newer patches 14.4 on older 14.3 version which caused a missing file, but could also cause other, possibly security issues.
 
So doing it from outside did not help.
I have jail hokuspokus2 on version 14.3 release and try to upgrade to the latest patch level of 14.3 branch. I run.

freebsd-update -b /jails/hokuspokus2/rootfs fetch


But it tries to upgrade to version 14.4-RELEASE-p7 . So it is the same like when I do it from inside? Why ?
 
You must log in or register to reply here.
Back
Top