chozahell

security and hardening options for systemd service units

A common and reliable pattern in service unit files is thus:

NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict

chozahell

Basic commands to view changes/information

To get an overview of the current system:

# systemd-analyze security

You must have Systemd version >= 240 for this to work. Check with systemd-analyze --version. If not... that sucks I guess? I don't know of a way to upgrade without horribly breaking everything.

chozahell

Brew install specific version / Locally freeze version

# Please define variables
packageName=<packageName>
packageVersion=<packageVersion>

# Create a new tab
brew tap-new local/$packageName

chozahell

output:
  init:
    output: "> /var/log/cloud-init.out"
    error: "> /var/log/cloud-init.err"
  config: "tee -a /var/log/cloud-config.log"
  final:
    - ">> /var/log/cloud-final.out"
    - "/var/log/cloud-final.err"

chozahell

Create Bridge interface on the host and give internet access

sudo ip link add name br0 type bridge
sudo ip addr add 172.20.0.1/24 dev br0
sudo ip link set dev br0 up
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables --table nat --append POSTROUTING --out-interface enp3s0 -j MASQUERADE
sudo iptables --insert FORWARD --in-interface br0 -j ACCEPT

Create a tap device and link to the bridge

chozahell

// Note that the templateFuncs refer to my apps helper package, left here
// in this example to help.

// Heavily inspired by the book https://www.sitepoint.com/premium/books/level-up-your-web-apps-with-go
// https://gitlab.com/snippets/1662623
// https://www.kylehq.com/2017/05/golang-templates---what-i-missed/
package templates

import (
	"bytes"

chozahell

##
zshzoo/zfunctions
zsh-users/zsh-completions
ohmyzsh/ohmyzsh path:plugins/colored-man-pages

##
zsh-users/zsh-syntax-highlighting
zsh-users/zsh-history-substring-search
zsh-users/zsh-autosuggestions