ansemjo

## systemd_service_hardening.md

      
              1 file
            
          
              1 fork
            
          
              0 comments
            
          
              1 star
            
          
                ansemjo
                / systemd_service_hardening.md
            
            
              Created
              May 20, 2022 14:36
                — forked from ageis/systemd_service_hardening.md
            
              
                Options for hardening systemd service units
              
          
    security and hardening options for systemd service units

A common and reliable pattern in service unit files is thus:
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict


## s3put.sh
#!/usr/bin/env bash
# https://gist.github.com/ansemjo/cc113ced5d133c018e95079ddb003bb0
set -e -o pipefail

usage() { cat >&2 <<USAGE
usage: s3put [-a acl] [-p pinnedkey] [-h] endpoint file objectpath
  -a acl       : use a different acl for uploaded files
  -p pinnedkey : sha256 pinned public key for certificate validation
  -h           : display this help
  endpoint     : endpoint url, e.g. https://s3.exmaple.com:9000

## ssh-auth-sock.service
# Place this file in ~/.config/systemd/user/ssh-auth-sock.service
# $ systemctl --user daemon-reload
# $ systemctl --user enable --now ssh-auth-sock.service
# Add 'echo UPDATESTARTUPTTY | gpg-connect-agent >/dev/null' in your ~/.bashrc.
# Logout or reboot.

[Unit]
Description=Set SSH_AUTH_SOCK to GnuPG agent

[Service]

## install-pacaur.sh
#!/bin/sh
#
# LICENSE AT END OF FILE
#
# This is a script to automatically install pacaur from the AUR. It is
# intended for fresh systems with no other means to install from AUR.
# Theoretically, this script can install other packages too. Just modify
# the $aurpkgs variable below.
#
	#!/usr/bin/env bash
	# https://gist.github.com/ansemjo/cc113ced5d133c018e95079ddb003bb0
	set -e -o pipefail

	usage() { cat >&2 <<USAGE
	usage: s3put [-a acl] [-p pinnedkey] [-h] endpoint file objectpath
	-a acl : use a different acl for uploaded files
	-p pinnedkey : sha256 pinned public key for certificate validation
	-h : display this help
	endpoint : endpoint url, e.g. https://s3.exmaple.com:9000
	# Place this file in ~/.config/systemd/user/ssh-auth-sock.service
	# $ systemctl --user daemon-reload
	# $ systemctl --user enable --now ssh-auth-sock.service
	# Add 'echo UPDATESTARTUPTTY \| gpg-connect-agent >/dev/null' in your ~/.bashrc.
	# Logout or reboot.

	[Unit]
	Description=Set SSH_AUTH_SOCK to GnuPG agent

	[Service]
	#!/bin/sh
	#
	# LICENSE AT END OF FILE
	#
	# This is a script to automatically install pacaur from the AUR. It is
	# intended for fresh systems with no other means to install from AUR.
	# Theoretically, this script can install other packages too. Just modify
	# the $aurpkgs variable below.
	#