Systemd/Hardening/ru - Revision history

FuzzyBot: Updating to match new version of source page

2025-10-07T21:26:13Z

Updating to match new version of source page

← Older revision		Revision as of 21:26, 7 October 2025
Line 18:		Line 18:
	</div>		</div>
	<div lang="en" dir="ltr" class="mw-content-ltr">		<div lang="en" dir="ltr" class="mw-content-ltr">
	While hardening a service, it often happens that you want a shell inside a hardened systemd unit, for ~~exemple~~ to check access to files, or check the network connectivity. One way to do this is to use tmux to create a session inside the service, and attaching to it outside of the service.		While hardening a service, it often happens that you want a shell inside a hardened systemd unit, for example to check access to files, or check the network connectivity. One way to do this is to use tmux to create a session inside the service, and attaching to it outside of the service.
	</div>		</div>
	Простой пример:		Простой пример:

Unabomberlive: Created page with "Опции служб Systemd по умолчанию довольно слабые по защищённости, поэтому часто бывает желательно рассмотреть способы усиления безопасности служб Systemd."

2024-08-20T08:33:42Z

Created page with "Опции служб Systemd по умолчанию довольно слабые по защищённости, поэтому часто бывает желательно рассмотреть способы усиления безопасности служб Systemd."

← Older revision		Revision as of 08:33, 20 August 2024
Line 1:		Line 1:
	{{Systemd/breadcrumb}}		{{Systemd/breadcrumb}}

	~~<div lang="en" dir="ltr" class="mw-content-ltr">~~		Опции служб Systemd по умолчанию довольно слабые по защищённости, поэтому часто бывает желательно рассмотреть способы усиления безопасности служб Systemd.
	Systemd~~'s service options are quite lax by default~~, ~~and so it is often desirable to look at ways to harden systemd services~~.
	~~</div>~~
	<div lang="en" dir="ltr" class="mw-content-ltr">		<div lang="en" dir="ltr" class="mw-content-ltr">
	A good way to get started on a given service is to look at the output of the command <code>systemd-analyze security myService</code>. From there, you can look at the documentation for the options you see in the output, often in <code>man systemd.exec</code> or <code>man systemd.resource-control</code>, and set the appropriate options for your service.		A good way to get started on a given service is to look at the output of the command <code>systemd-analyze security myService</code>. From there, you can look at the documentation for the options you see in the output, often in <code>man systemd.exec</code> or <code>man systemd.resource-control</code>, and set the appropriate options for your service.

Unabomberlive: Created page with " { pkgs }: { systemd.services.myService = { serviceConfig = { ExecStart = "${pkgs.tmux}/bin/tmux -S /run/myService/tmux.socket new-session -s my-session -d"; ExecStop = "${pkgs.tmux}/bin/tmux -S /run/myService/tmux.socket kill-session -t my-session"; Type = "forking";"

2024-08-12T10:02:32Z

Created page with "<syntaxhighlight lang="nix"> { pkgs }: { systemd.services.myService = { serviceConfig = { ExecStart = "${pkgs.tmux}/bin/tmux -S /run/myService/tmux.socket new-session -s my-session -d"; ExecStop = "${pkgs.tmux}/bin/tmux -S /run/myService/tmux.socket kill-session -t my-session"; Type = "forking";"

← Older revision		Revision as of 10:02, 12 August 2024
Line 41:		Line 41:
	Example with a <code>RootDirectory</code> specified:		Example with a <code>RootDirectory</code> specified:
	</div>		</div>
	~~<div lang="en" dir="ltr" class="mw-content-ltr">~~
	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
	{ pkgs }:		{ pkgs }:
Line 50:		Line 49:
	ExecStop = "${pkgs.tmux}/bin/tmux -S /run/myService/tmux.socket kill-session -t my-session";		ExecStop = "${pkgs.tmux}/bin/tmux -S /run/myService/tmux.socket kill-session -t my-session";
	Type = "forking";		Type = "forking";
	~~</div>~~

	<div lang="en" dir="ltr" class="mw-content-ltr">		<div lang="en" dir="ltr" class="mw-content-ltr">

Unabomberlive: Created page with "BindReadOnlyPaths = [ "/nix/store""

2024-08-12T10:02:10Z

Created page with "BindReadOnlyPaths = [ "/nix/store""

← Older revision		Revision as of 10:02, 12 August 2024
Line 58:		Line 58:
	</div>		</div>

	~~<div lang="en" dir="ltr" class="mw-content-ltr">~~		BindReadOnlyPaths = [
	BindReadOnlyPaths = [
	"/nix/store"		"/nix/store"
	~~</div>~~

	<div lang="en" dir="ltr" class="mw-content-ltr">		<div lang="en" dir="ltr" class="mw-content-ltr">

Unabomberlive: Created page with "Простой пример:"

2024-08-08T17:29:33Z

Created page with "Простой пример:"

← Older revision		Revision as of 17:29, 8 August 2024
Line 22:		Line 22:
	While hardening a service, it often happens that you want a shell inside a hardened systemd unit, for exemple to check access to files, or check the network connectivity. One way to do this is to use tmux to create a session inside the service, and attaching to it outside of the service.		While hardening a service, it often happens that you want a shell inside a hardened systemd unit, for exemple to check access to files, or check the network connectivity. One way to do this is to use tmux to create a session inside the service, and attaching to it outside of the service.
	</div>		</div>
	~~<div lang="en" dir="ltr" class="mw-content-ltr">~~		Простой пример:
	~~Simple example~~:
	~~</div>~~
	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">

Unabomberlive: Created page with "== См. Также =="

2024-08-08T08:40:58Z

Created page with "== См. Также =="

← Older revision		Revision as of 08:40, 8 August 2024
Line 97:		Line 97:
	* TheLounge: https://github.com/thelounge/thelounge-deb/pull/78		* TheLounge: https://github.com/thelounge/thelounge-deb/pull/78
	</div>		</div>
	<~~div lang~~="~~en" dir="ltr" class="mw-content-ltr~~">		<span id="Related_links"></span>
	== ~~Related links~~ ==		== См. Также ==
	~~</div>~~
	<div lang="en" dir="ltr" class="mw-content-ltr">		<div lang="en" dir="ltr" class="mw-content-ltr">
	* SHH, systemd hardening helper: [https://www.synacktiv.com/en/publications/systemd-hardening-made-easy-with-shh systemd hardening made easy with SHH]		* SHH, systemd hardening helper: [https://www.synacktiv.com/en/publications/systemd-hardening-made-easy-with-shh systemd hardening made easy with SHH]

Unabomberlive: Created page with "Systemd/Hardening"

2024-08-08T08:39:26Z

Created page with "Systemd/Hardening"

New page

{{Systemd/breadcrumb}}

<div lang="en" dir="ltr" class="mw-content-ltr">
Systemd's service options are quite lax by default, and so it is often desirable to look at ways to harden systemd services.
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
A good way to get started on a given service is to look at the output of the command <code>systemd-analyze security myService</code>. From there, you can look at the documentation for the options you see in the output, often in <code>man systemd.exec</code> or <code>man systemd.resource-control</code>, and set the appropriate options for your service.
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
== Accessing the network with a different RootDirectory ==
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
To be able to access the network while having a RootDirectory specified, you need to give access to <code>/etc/ssl</code>, <code>/etc/static/ssl</code> and <code>/etc/resolv.conf</code>. The simplest way of doing this is by simply putting <code>/etc</code> in the <code>BindReadOnlyPaths</code> option.
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
A more granular way, would be to put these 3 paths into <code>BindReadOnlyPaths</code>, and wait for the creation of <code>/etc/resolv.conf</code> through a <code>systemd.path</code> unit.
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
== Dropping a shell inside a systemd service ==
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
While hardening a service, it often happens that you want a shell inside a hardened systemd unit, for exemple to check access to files, or check the network connectivity. One way to do this is to use tmux to create a session inside the service, and attaching to it outside of the service.
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
Simple example:
</div>
<syntaxhighlight lang="nix">

{ pkgs, ... }:
{
systemd.services.myService = {
serviceConfig = {
ExecStart = "${pkgs.tmux}/bin/tmux -S /tmp/tmux.socket new-session -s my-session -d";
ExecStop = "${pkgs.tmux}/bin/tmux -S /tmp/tmux.socket kill-session -t my-session";
Type = "forking";

# ...
};
};
}
</syntaxhighlight>
<div lang="en" dir="ltr" class="mw-content-ltr">
Example with a <code>RootDirectory</code> specified:
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
<syntaxhighlight lang="nix">
{ pkgs }:
{
systemd.services.myService = {
serviceConfig = {
ExecStart = "${pkgs.tmux}/bin/tmux -S /run/myService/tmux.socket new-session -s my-session -d";
ExecStop = "${pkgs.tmux}/bin/tmux -S /run/myService/tmux.socket kill-session -t my-session";
Type = "forking";
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
# Used as root directory
RuntimeDirectory = "myService";
RootDirectory = "/run/myService";
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
BindReadOnlyPaths = [
"/nix/store"
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
# So tmux uses /bin/sh as shell
"/bin"
];
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
# This sets up a private /dev/tty
# The tmux server would crash without this
# since there would be nothing in /dev
PrivateDevices = true;
};
};
}
</syntaxhighlight>
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
To attach to the shell, simply execute <code>tmux -S /path/to/tmux.socket attach</code>.
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
== Hardening examples ==
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
This list contains proposed hardening options that are not yet upstreamed. Please use with caution, and please notify the author of the change if something breaks:
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
* Chrony: https://github.com/NixOS/nixpkgs/pull/104944/files
* Isso: https://github.com/NixOS/nixpkgs/pull/140840/files
* Mautrix-based bridge: https://github.com/mautrix/docs/pull/18/files
* Postfix: https://github.com/NixOS/nixpkgs/pull/93305/files
* TheLounge: https://github.com/thelounge/thelounge-deb/pull/78
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
== Related links ==
</div>
<div lang="en" dir="ltr" class="mw-content-ltr">
* SHH, systemd hardening helper: [https://www.synacktiv.com/en/publications/systemd-hardening-made-easy-with-shh systemd hardening made easy with SHH]
</div>

[[Category:NixOS]]
[[Category:Cookbook]]
[[Category:Security]]
[[Category:systemd]]