SystemD Service Hardening
roguesecurity.dev
Discover additional security options for systemd units, to include quadlets. These options are everything from system permissions, time manage, BPF, syscall & seccomp filters, etc., all to make your system more secure.

cross-posted from: https://infosec.pub/post/32937284

This one is a little self-hosting specific, and more casual Linux best practices, but I’ve got a new blog post down for general security! Harden your systemd units (especially custom ones) for better peace of mind on the internet!

  • MysteriousSophon21@lemmy.worldEnglish
    4·
    22 days ago

    Adding PrivateNetwork=yes to your systemd units is a game changer for services that don’t need network access - it completly isolates the service from the network and prevents any outbound connections.

    • StarkZarn@infosec.pubOPEnglish
      2·
      22 days ago

      Good callout! You’re absolutely right, and here I was primarily focused on publicly accessible services. Thanks for the addition.