Systemd/Hardening - Revision history

桃源郷: First time editing the wiki, apologies if I did anything wrong! I didn't want to remove the tmux stuff added by others, so I kept my changes to a sentence or two inserted before it

2025-12-30T04:01:12Z

First time editing the wiki, apologies if I did anything wrong! I didn't want to remove the tmux stuff added by others, so I kept my changes to a sentence or two inserted before it

← Older revision		Revision as of 04:01, 30 December 2025
Line 25:		Line 25:
	<translate>		<translate>
	<!--T:7-->		<!--T:7-->
	While hardening a service, it often happens that you want a shell inside a hardened systemd unit, for example to check access to files, or check the network connectivity. ~~One way~~ to do this ~~is to~~ use tmux to create a session inside the service, and attaching to it outside of the service.		While hardening a service, it often happens that you want a shell inside a hardened systemd unit, for example to check access to files, or check the network connectivity. Since systemd v258, one may run <code>systemd-analyze unit-shell <service></code> to accomplish this. Note that this [https://mastodon.social/@zihco/114823612021351075 currently] only works for running services. Alternatively, one might use tmux to create a session inside the service, and attaching to it outside of the service.
	</translate>		</translate>
	<translate>		<translate>

Kiri: Fix small typo

2025-01-20T09:51:29Z

Fix small typo

← Older revision		Revision as of 09:51, 20 January 2025
Line 25:		Line 25:
	<translate>		<translate>
	<!--T:7-->		<!--T:7-->
	While hardening a service, it often happens that you want a shell inside a hardened systemd unit, for ~~exemple~~ to check access to files, or check the network connectivity. One way to do this is to use tmux to create a session inside the service, and attaching to it outside of the service.		While hardening a service, it often happens that you want a shell inside a hardened systemd unit, for example to check access to files, or check the network connectivity. One way to do this is to use tmux to create a session inside the service, and attaching to it outside of the service.
	</translate>		</translate>
	<translate>		<translate>

Unabomberlive: Marked this version for translation

2024-08-08T08:36:55Z

Marked this version for translation

← Older revision		Revision as of 08:36, 8 August 2024
Line 2:		Line 2:

	<translate>		<translate>
			<!--T:1-->
	Systemd's service options are quite lax by default, and so it is often desirable to look at ways to harden systemd services.		Systemd's service options are quite lax by default, and so it is often desirable to look at ways to harden systemd services.
	</translate>		</translate>
	<translate>		<translate>
			<!--T:2-->
	A good way to get started on a given service is to look at the output of the command <code>systemd-analyze security myService</code>. From there, you can look at the documentation for the options you see in the output, often in <code>man systemd.exec</code> or <code>man systemd.resource-control</code>, and set the appropriate options for your service.		A good way to get started on a given service is to look at the output of the command <code>systemd-analyze security myService</code>. From there, you can look at the documentation for the options you see in the output, often in <code>man systemd.exec</code> or <code>man systemd.resource-control</code>, and set the appropriate options for your service.
	</translate>		</translate>
	<translate>		<translate>
	== Accessing the network with a different RootDirectory ==		== Accessing the network with a different RootDirectory == <!--T:3-->
	</translate>		</translate>
	<translate>		<translate>
			<!--T:4-->
	To be able to access the network while having a RootDirectory specified, you need to give access to <code>/etc/ssl</code>, <code>/etc/static/ssl</code> and <code>/etc/resolv.conf</code>. The simplest way of doing this is by simply putting <code>/etc</code> in the <code>BindReadOnlyPaths</code> option.		To be able to access the network while having a RootDirectory specified, you need to give access to <code>/etc/ssl</code>, <code>/etc/static/ssl</code> and <code>/etc/resolv.conf</code>. The simplest way of doing this is by simply putting <code>/etc</code> in the <code>BindReadOnlyPaths</code> option.
	</translate>		</translate>
	<translate>		<translate>
			<!--T:5-->
	A more granular way, would be to put these 3 paths into <code>BindReadOnlyPaths</code>, and wait for the creation of <code>/etc/resolv.conf</code> through a <code>systemd.path</code> unit.		A more granular way, would be to put these 3 paths into <code>BindReadOnlyPaths</code>, and wait for the creation of <code>/etc/resolv.conf</code> through a <code>systemd.path</code> unit.
	</translate>		</translate>
	<translate>		<translate>
	== Dropping a shell inside a systemd service ==		== Dropping a shell inside a systemd service == <!--T:6-->
	</translate>		</translate>
	<translate>		<translate>
			<!--T:7-->
	While hardening a service, it often happens that you want a shell inside a hardened systemd unit, for exemple to check access to files, or check the network connectivity. One way to do this is to use tmux to create a session inside the service, and attaching to it outside of the service.		While hardening a service, it often happens that you want a shell inside a hardened systemd unit, for exemple to check access to files, or check the network connectivity. One way to do this is to use tmux to create a session inside the service, and attaching to it outside of the service.
	</translate>		</translate>
	<translate>		<translate>
			<!--T:8-->
	Simple example:		Simple example:
	</translate>		</translate>
Line 41:		Line 47:
	</syntaxhighlight>		</syntaxhighlight>
	<translate>		<translate>
			<!--T:9-->
	Example with a <code>RootDirectory</code> specified:		Example with a <code>RootDirectory</code> specified:
	</translate>		</translate>
	<translate>		<translate>
			<!--T:10-->
	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
	{ pkgs }:		{ pkgs }:
Line 53:		Line 61:
	Type = "forking";		Type = "forking";

	# Used as root directory		<!--T:11-->
			# Used as root directory
	RuntimeDirectory = "myService";		RuntimeDirectory = "myService";
	RootDirectory = "/run/myService";		RootDirectory = "/run/myService";

	BindReadOnlyPaths = [		<!--T:12-->
			BindReadOnlyPaths = [
	"/nix/store"		"/nix/store"

	# So tmux uses /bin/sh as shell		<!--T:13-->
			# So tmux uses /bin/sh as shell
	"/bin"		"/bin"
	];		];

	# This sets up a private /dev/tty		<!--T:14-->
			# This sets up a private /dev/tty
	# The tmux server would crash without this		# The tmux server would crash without this
	# since there would be nothing in /dev		# since there would be nothing in /dev
Line 74:		Line 86:
	</translate>		</translate>
	<translate>		<translate>
			<!--T:15-->
	To attach to the shell, simply execute <code>tmux -S /path/to/tmux.socket attach</code>.		To attach to the shell, simply execute <code>tmux -S /path/to/tmux.socket attach</code>.
	</translate>		</translate>
	<translate>		<translate>
	== Hardening examples ==		== Hardening examples == <!--T:16-->
	</translate>		</translate>
	<translate>		<translate>
			<!--T:17-->
	This list contains proposed hardening options that are not yet upstreamed. Please use with caution, and please notify the author of the change if something breaks:		This list contains proposed hardening options that are not yet upstreamed. Please use with caution, and please notify the author of the change if something breaks:
	</translate>		</translate>
	<translate>		<translate>
			<!--T:18-->
	* Chrony: https://github.com/NixOS/nixpkgs/pull/104944/files		* Chrony: https://github.com/NixOS/nixpkgs/pull/104944/files
	* Isso: https://github.com/NixOS/nixpkgs/pull/140840/files		* Isso: https://github.com/NixOS/nixpkgs/pull/140840/files
Line 90:		Line 105:
	</translate>		</translate>
	<translate>		<translate>
	== Related links ==		== Related links == <!--T:19-->
	</translate>		</translate>
	<translate>		<translate>
			<!--T:20-->
	* SHH, systemd hardening helper: [https://www.synacktiv.com/en/publications/systemd-hardening-made-easy-with-shh systemd hardening made easy with SHH]		* SHH, systemd hardening helper: [https://www.synacktiv.com/en/publications/systemd-hardening-made-easy-with-shh systemd hardening made easy with SHH]
	</translate>		</translate>

Unabomberlive at 08:36, 8 August 2024

2024-08-08T08:36:49Z

← Older revision		Revision as of 08:36, 8 August 2024
Line 1:		Line 1:
	{{Systemd/breadcrumb}}		{{Systemd/breadcrumb}}

			<translate>
	Systemd's service options are quite lax by default, and so it is often desirable to look at ways to harden systemd services.		Systemd's service options are quite lax by default, and so it is often desirable to look at ways to harden systemd services.
			</translate>
			<translate>
	A good way to get started on a given service is to look at the output of the command <code>systemd-analyze security myService</code>. From there, you can look at the documentation for the options you see in the output, often in <code>man systemd.exec</code> or <code>man systemd.resource-control</code>, and set the appropriate options for your service.		A good way to get started on a given service is to look at the output of the command <code>systemd-analyze security myService</code>. From there, you can look at the documentation for the options you see in the output, often in <code>man systemd.exec</code> or <code>man systemd.resource-control</code>, and set the appropriate options for your service.
			</translate>
			<translate>
	== Accessing the network with a different RootDirectory ==		== Accessing the network with a different RootDirectory ==
			</translate>
			<translate>
	To be able to access the network while having a RootDirectory specified, you need to give access to <code>/etc/ssl</code>, <code>/etc/static/ssl</code> and <code>/etc/resolv.conf</code>. The simplest way of doing this is by simply putting <code>/etc</code> in the <code>BindReadOnlyPaths</code> option.		To be able to access the network while having a RootDirectory specified, you need to give access to <code>/etc/ssl</code>, <code>/etc/static/ssl</code> and <code>/etc/resolv.conf</code>. The simplest way of doing this is by simply putting <code>/etc</code> in the <code>BindReadOnlyPaths</code> option.
			</translate>
			<translate>
	A more granular way, would be to put these 3 paths into <code>BindReadOnlyPaths</code>, and wait for the creation of <code>/etc/resolv.conf</code> through a <code>systemd.path</code> unit.		A more granular way, would be to put these 3 paths into <code>BindReadOnlyPaths</code>, and wait for the creation of <code>/etc/resolv.conf</code> through a <code>systemd.path</code> unit.
			</translate>
			<translate>
	== Dropping a shell inside a systemd service ==		== Dropping a shell inside a systemd service ==
			</translate>
			<translate>
	While hardening a service, it often happens that you want a shell inside a hardened systemd unit, for exemple to check access to files, or check the network connectivity. One way to do this is to use tmux to create a session inside the service, and attaching to it outside of the service.		While hardening a service, it often happens that you want a shell inside a hardened systemd unit, for exemple to check access to files, or check the network connectivity. One way to do this is to use tmux to create a session inside the service, and attaching to it outside of the service.
			</translate>
			<translate>
	Simple example:		Simple example:
			</translate>
	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">

Line 32:		Line 40:
	}		}
	</syntaxhighlight>		</syntaxhighlight>
			<translate>
	Example with a <code>RootDirectory</code> specified:		Example with a <code>RootDirectory</code> specified:
			</translate>
			<translate>
	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
	{ pkgs }:		{ pkgs }:
Line 63:		Line 72:
	}		}
	</syntaxhighlight>		</syntaxhighlight>
			</translate>
			<translate>
	To attach to the shell, simply execute <code>tmux -S /path/to/tmux.socket attach</code>.		To attach to the shell, simply execute <code>tmux -S /path/to/tmux.socket attach</code>.
			</translate>
			<translate>
	== Hardening examples ==		== Hardening examples ==
			</translate>
			<translate>
	This list contains proposed hardening options that are not yet upstreamed. Please use with caution, and please notify the author of the change if something breaks:		This list contains proposed hardening options that are not yet upstreamed. Please use with caution, and please notify the author of the change if something breaks:
			</translate>
			<translate>
	* Chrony: https://github.com/NixOS/nixpkgs/pull/104944/files		* Chrony: https://github.com/NixOS/nixpkgs/pull/104944/files
	* Isso: https://github.com/NixOS/nixpkgs/pull/140840/files		* Isso: https://github.com/NixOS/nixpkgs/pull/140840/files
Line 75:		Line 88:
	* Postfix: https://github.com/NixOS/nixpkgs/pull/93305/files		* Postfix: https://github.com/NixOS/nixpkgs/pull/93305/files
	* TheLounge: https://github.com/thelounge/thelounge-deb/pull/78		* TheLounge: https://github.com/thelounge/thelounge-deb/pull/78
			</translate>
			<translate>
	== Related links ==		== Related links ==
			</translate>
	* SHH, systemd hardening helper: [https://www.synacktiv.com/en/publications/systemd-hardening-made-easy-with-shh systemd hardening made easy with SHH]		<translate>
			* SHH, systemd hardening helper: [https://www.synacktiv.com/en/publications/systemd-hardening-made-easy-with-shh systemd hardening made easy with SHH]
			</translate>

	[[Category:NixOS]]		[[Category:NixOS]]

Klinger at 21:31, 24 April 2024

2024-04-24T21:31:10Z

← Older revision		Revision as of 21:31, 24 April 2024
Line 83:		Line 83:
	[[Category:Cookbook]]		[[Category:Cookbook]]
	[[Category:Security]]		[[Category:Security]]
			[[Category:systemd]]

Claes: Add link to SHH, systemd hardening helper

2024-04-03T19:35:58Z

Add link to SHH, systemd hardening helper

← Older revision		Revision as of 19:35, 3 April 2024
Line 75:		Line 75:
	* Postfix: https://github.com/NixOS/nixpkgs/pull/93305/files		* Postfix: https://github.com/NixOS/nixpkgs/pull/93305/files
	* TheLounge: https://github.com/thelounge/thelounge-deb/pull/78		* TheLounge: https://github.com/thelounge/thelounge-deb/pull/78

			== Related links ==

			* SHH, systemd hardening helper: [https://www.synacktiv.com/en/publications/systemd-hardening-made-easy-with-shh systemd hardening made easy with SHH]

	[[Category:NixOS]]		[[Category:NixOS]]
	[[Category:Cookbook]]		[[Category:Cookbook]]
	[[Category:Security]]		[[Category:Security]]

0x4A6F at 18:28, 3 April 2024

2024-04-03T18:28:20Z

← Older revision		Revision as of 18:28, 3 April 2024
Line 1:		Line 1:
			{{Systemd/breadcrumb}}

	Systemd's service options are quite lax by default, and so it is often desirable to look at ways to harden systemd services.		Systemd's service options are quite lax by default, and so it is often desirable to look at ways to harden systemd services.

0x4A6F: 0x4A6F moved page Systemd Hardening to Systemd/Hardening

2024-04-03T18:23:28Z

0x4A6F moved page Systemd Hardening to Systemd/Hardening

← Older revision		Revision as of 18:23, 3 April 2024
(No difference)

imported>Erdnaxe: Remove merged hardening options

2022-09-24T12:58:12Z

Remove merged hardening options

← Older revision		Revision as of 12:58, 24 September 2022
Line 69:		Line 69:

	* Chrony: https://github.com/NixOS/nixpkgs/pull/104944/files		* Chrony: https://github.com/NixOS/nixpkgs/pull/104944/files
	* Galène: https://github.com/NixOS/nixpkgs/pull/156163/files
	* Isso: https://github.com/NixOS/nixpkgs/pull/140840/files		* Isso: https://github.com/NixOS/nixpkgs/pull/140840/files
	* Libreddit: https://github.com/NixOS/nixpkgs/pull/133771/files
	* Mautrix-based bridge: https://github.com/mautrix/docs/pull/18/files		* Mautrix-based bridge: https://github.com/mautrix/docs/pull/18/files
	* Postfix: https://github.com/NixOS/nixpkgs/pull/93305/files		* Postfix: https://github.com/NixOS/nixpkgs/pull/93305/files

imported>Erdnaxe: /* Hardening examples */ Add link to TheLounge hardening

2022-01-28T10:04:04Z

Hardening examples: Add link to TheLounge hardening

← Older revision		Revision as of 10:04, 28 January 2022
Line 74:		Line 74:
	* Mautrix-based bridge: https://github.com/mautrix/docs/pull/18/files		* Mautrix-based bridge: https://github.com/mautrix/docs/pull/18/files
	* Postfix: https://github.com/NixOS/nixpkgs/pull/93305/files		* Postfix: https://github.com/NixOS/nixpkgs/pull/93305/files
			* TheLounge: https://github.com/thelounge/thelounge-deb/pull/78

	[[Category:NixOS]]		[[Category:NixOS]]
	[[Category:Cookbook]]		[[Category:Cookbook]]
	[[Category:Security]]		[[Category:Security]]