Viktor Smychyk vsmychyk

## systemd_service_hardening.md

      
              1 file
            
          
              49 forks
            
          
              8 comments
            
          
              350 stars
            
          
                ageis
                / systemd_service_hardening.md
            
            
              Last active
              July 23, 2024 01:07
            
              
                Options for hardening systemd service units
              
          
    security and hardening options for systemd service units

A common and reliable pattern in service unit files is thus:
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict


## args_script_template.sh
#!/bin/bash
set -e

usage="$(basename "$0") [-h] [-i PROJECT] [-v VM] [-p PYTHON] [-d NOTEBOOKS]
Make a user provide SSH key and jupyter notebooks (in roles/bootstrap/files/notebooks) to each user listed in var/common.yml
where:
    -h  show this help text
    -i  google cloud project id
    -v  name of instance/virtual machine
    -p  python path

## jinja2-omit-comma-from-item.txt.j2
# Courtesy of: https://stackoverflow.com/a/11974399

{%- for item in items %}
[
"{{item}}"{{ "," if not loop.last }}
]
{%- endfor %}
	#!/bin/bash
	set -e

	usage="$(basename "$0") [-h] [-i PROJECT] [-v VM] [-p PYTHON] [-d NOTEBOOKS]
	Make a user provide SSH key and jupyter notebooks (in roles/bootstrap/files/notebooks) to each user listed in var/common.yml
	where:
	-h show this help text
	-i google cloud project id
	-v name of instance/virtual machine
	-p python path
	# Courtesy of: https://stackoverflow.com/a/11974399

	{%- for item in items %}
	[
	"{{item}}"{{ "," if not loop.last }}
	]
	{%- endfor %}