How to Troubleshoot Jailshell Problems on a Virtuozzo or OpenVZ VPS

Overview

This document explains common problems that occur on systems that use a jailed shell environment on a Virtuozzo or OpenVZ virtual private server (VPS).

User and mount limits

CentOS 6 and older support a maximum of only 256 jailshell users on a system that uses the Apache mod_ruid2 module. If you encounter this limit, you should consider an upgrade to a newer operating system.

Some customers have reported performance and connection issues when they attempt to mount more than 4000 targets in a Virtuozzo environment. If you encounter this limit and still require a large number of jailshelled users, you should consider a different virtualization platform.

Full /proc mount for jailed shell users

Users on a server may have a full, rather than limited, /proc mount, even though you select a limited /proc option for the Jailed /proc mount method in the System section of WHM’s Tweak Settings interface (WHM >> Home >> Server Configuration >> Tweak Settings). This issue allows jailed shell users to view the complete process list on the server.

To verify whether this problem exists on your server, perform the following steps:

1. SSH in to the server as a jailed shell user.
2. Run the ps axu command.

If the command returns the complete process list for the server, the user has a full /proc mount.

This problem occurs because the clone() system call did not accept the CLONE_NEWPID flag. You must set the sys_admin capability to on for the clone() system call to handle this flag correctly.

To set the sys_admin capability to on, run the following command:

vzctl set CTID --save --capability sys_admin:on

Unable to set uids error

The system may return the following error when users attempt to access the jailed shell environment:

Unable to set uids

This problem generally occurs due to a conflict with custom hard nproc settings in the /etc/security/limits.conf file. Custom values for these settings may also cause problems with account creation.

To resolve this issue, revert the hard nproc settings to their default values.

MySQL® connection errors

Sites may return MySQL connection errors when you enable the _Jail Apache Virtual Hosts using modruid2 and cPanel® jailshell setting in WHM’s Tweak Settings interface (WHM >> Home >> Server Configuration >> Tweak Settings).

This problem generally occurs due to a restriction of the loop device limit within OpenVZ.

To resolve this issue, perform the following steps to increase the loop device limit:

1. In the /etc/grub.conf file, add max_loop=256 as a kernel parameter.
2. Reboot the server.

3. Run the following command:

   /sbin/MAKEDEV -v /dev/loop

4. Repeat these steps for the VPS node and VPS container.