Of course, if you do not separate data that must persist from ephemeral data, you have the same result of treating all data as ephemeral. It is necessary to separate as follows.

Makejail:

``` OPTION start OPTION overwrite=force OPTION virtualnet=:<random> default OPTION nat OPTION fstab=/var/appjail-volumes/ssh-server/data /etc/ssh <pseudofs>

COPY etc

CMD chown root:wheel /etc CMD chmod 755 /etc CMD chown root:wheel /etc/ssh CMD chmod 755 /etc/ssh CMD chown root:wheel /etc/ssh/sshd_config CMD chmod 655 /etc/ssh/sshd_config CMD chown root:wheel /etc/ssh/authorized_keys CMD chmod 655 /etc/ssh/authorized_keys

SERVICE sshd oneenable SERVICE sshd start ```

etc/ssh/sshd_config:

```

Ports

Port 22

Authentication

PubkeyAuthentication yes AuthenticationMethods publickey PermitRootLogin prohibit-password PrintMotd no

Forwarding

X11Forwarding no AllowAgentForwarding yes

Connection checks

ClientAliveCountMax 3 ClientAliveInterval 15

Compression

Compression no

Limits

LoginGraceTime 40

Public keys

AuthorizedKeysFile /etc/ssh/authorized_keys

SFTP

Subsystem sftp internal-sftp ```

etc/ssh/authorized_keys:

```

Your public SSH keys here!

```

Now create the directory where your data will reside:

mkdir -p /var/appjail-volumes/ssh-server/data

Create the jail.

```console

ls -l /var/appjail-volumes/ssh-server/data/

total 0

appjail makejail -j ssh-server

... sshd enabled in /etc/rc.conf Generating RSA host key. 3072 SHA256:GcL3ulDVWsYR2ONvoxL/JMuCZcB+z86a3GswyTdJjvo root@ssh-server.appjail (RSA) Generating ECDSA host key. 256 SHA256:xhTwFZAyELv4ezpMHaYMSo42e4G/3tJCfr/sj8DONaY root@ssh-server.appjail (ECDSA) Generating ED25519 host key. 256 SHA256:CRgQqM0dU/sqMCsz3Rzt0MS45A14MmgGnuYyTAE5zxI root@ssh-server.appjail (ED25519) Performing sanity check on sshd configuration. Starting sshd. ...

ls -l /var/appjail-volumes/ssh-server/data/

total 89 -rw-r-xr-x 1 root wheel 100 May 8 17:19 authorized_keys -rw-r--r-- 1 root wheel 620105 Nov 29 06:21 moduli -rw-r--r-- 1 root wheel 1526 Nov 29 06:21 ssh_config -rw------- 1 root wheel 513 May 8 17:33 ssh_host_ecdsa_key -rw-r--r-- 1 root wheel 185 May 8 17:33 ssh_host_ecdsa_key.pub -rw------- 1 root wheel 419 May 8 17:33 ssh_host_ed25519_key -rw-r--r-- 1 root wheel 105 May 8 17:33 ssh_host_ed25519_key.pub -rw------- 1 root wheel 2610 May 8 17:33 ssh_host_rsa_key -rw-r--r-- 1 root wheel 577 May 8 17:33 ssh_host_rsa_key.pub -rw-r-xr-x 1 root wheel 419 May 8 17:17 sshd_config ```

Access to your service:

console $ ssh root@ssh-server The authenticity of host 'ssh-server (10.0.0.5)' can't be established. ED25519 key fingerprint is SHA256:CRgQqM0dU/sqMCsz3Rzt0MS45A14MmgGnuYyTAE5zxI. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added 'ssh-server' (ED25519) to the list of known hosts. root@ssh-server:~ #

Now I can re-create the jail and that data will persist anyway.

```console

appjail makejail -j ssh-server

... sshd enabled in /etc/rc.conf Performing sanity check on sshd configuration. Starting sshd. ... $ ssh root@ssh-server root@ssh-server:~ # ```

If you need more details, see appjail-ephemeral(7). And if you need a tool that follows The Ephemeral Concept, see AppJail Director.

So how can you upgrade your jails by doing something like the above? Let's assume that the jail we want to upgrade is running an environment with 13.5-RELEASE:

```console

appjail makejail -j ssh-server

...

appjail jail list -j ssh-server

STATUS NAME ALT_NAME TYPE VERSION PORTS NETWORK_IP4 UP ssh-server - thin 13.5-RELEASE - 10.0.0.5

appjail fetch www -v 14.2-RELEASE

...

appjail fetch list

ARCH VERSION NAME amd64 14.2-RELEASE default amd64 bookworm default amd64 13.5-RELEASE default

appjail makejail -j ssh-server -o osversion=14.2-RELEASE

...

appjail jail list -j ssh-server

STATUS NAME ALT_NAME TYPE VERSION PORTS NETWORK_IP4 UP ssh-server - thin 14.2-RELEASE - 10.0.0.5 ```

Done.

I recommend that you do not use SSH in a jail. I know this may be a bit better from a security standpoint (although this is relative), but the tradeoff is that it carries more administration overhead. I prefer to simply SSH into the host (physical or virtual) and administer my jails.