chozahell

security and hardening options for systemd service units

A common and reliable pattern in service unit files is thus:

NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict

Basic commands to view changes/information

To get an overview of the current system:

# systemd-analyze security

You must have Systemd version >= 240 for this to work. Check with systemd-analyze --version. If not... that sucks I guess? I don't know of a way to upgrade without horribly breaking everything.

Brew install specific version / Locally freeze version

# Please define variables
packageName=<packageName>
packageVersion=<packageVersion>

# Create a new tab
brew tap-new local/$packageName

Create Bridge interface on the host and give internet access

sudo ip link add name br0 type bridge
sudo ip addr add 172.20.0.1/24 dev br0
sudo ip link set dev br0 up
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables --table nat --append POSTROUTING --out-interface enp3s0 -j MASQUERADE
sudo iptables --insert FORWARD --in-interface br0 -j ACCEPT

Create a tap device and link to the bridge

	output:
	init:
	output: "> /var/log/cloud-init.out"
	error: "> /var/log/cloud-init.err"
	config: "tee -a /var/log/cloud-config.log"
	final:
	- ">> /var/log/cloud-final.out"
	- "/var/log/cloud-final.err"

	// Note that the templateFuncs refer to my apps helper package, left here
	// in this example to help.

	// Heavily inspired by the book https://www.sitepoint.com/premium/books/level-up-your-web-apps-with-go
	// https://gitlab.com/snippets/1662623
	// https://www.kylehq.com/2017/05/golang-templates---what-i-missed/
	package templates

	import (
	"bytes"

	##
	zshzoo/zfunctions
	zsh-users/zsh-completions
	ohmyzsh/ohmyzsh path:plugins/colored-man-pages

	##
	zsh-users/zsh-syntax-highlighting
	zsh-users/zsh-history-substring-search
	zsh-users/zsh-autosuggestions