Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen der Seite angezeigt.

--- admin_grundlagen:systemd_service_unit_files [2018/08/16 07:22] – ingo_wichmann
+++ admin_grundlagen:systemd_service_unit_files [2025/09/02 13:23] (aktuell) – ingo_wichmann
@@ Zeile 8: / Zeile 8: @@
 ExecStart=/usr/bin/nc -l -p 5000
 </file>
+((
+Lennart Poettering [[https://mastodon.social/@pid_eins/115128485057447501|schreibt]] auf die Frage, warum alle Netzwerkdienste Socket Activation nutzen sollten:
+"robustness (because your service can go away, and then get restarted without clients noticing much), security (because priv code in pid1 binds the socket, and service can be entirely unpriv), resource use (because you can bind thousands of sockets, without having to pay upfront for starting the services behind), flexibility (because admins can configure .socket units in a *lot* of detail, and schedule binding of sockets precisely, for example bind certain IP sockets only after some network interface showed up and has been configured), simplicity (because as mentioned you don't need to configure deps anymore), compatibility with soft-reboot, … and the list goes on and on and on and on…"
+))
 Syntax des Unit Files prüfen:
@@ Zeile 48: / Zeile 54: @@
   systemctl enable nc
+Nach beendeter Verbindung neustarten:
+<file txt /etc/systemd/system/nc.service>
+…
+[Service]
+…
+Restart=always
+</file>
 ====== Beispiel für ein User Service Unit ======
@@ Zeile 100: / Zeile 116: @@
 VMDELAY="5"
 VMLOGFILE="/tmp/vmstat.log"
+</file>
+====== Dienste absichern ======
+((Lennart Poettering schreibt: //There's quite some stuff now we
+should enable wherever we can. Specifically ProtectSystem=,
+ProtectHome=, ProtectKernelTunables=, ProtectKernelModules=,
+ProtectedControlGroups=, PrivateUsers=, PrivateTmp=, PrivateDevices=,
+PrivateNetwork=, SystemCallFilter=, RestrictAddressFamilies=,
+RestrictNamespaces=, MemoryDenyWriteExecute=, RestrictRealtime=// https://lwn.net/Articles/709764/))
+TODO: noch nicht getestet
+<file txt>
+ProtectSystem=full
+</file>
+oder
+<file txt>
+ProtectSystem=strict
+ReadWritePaths=/var/lib/…
+ReadOnlyPaths=/var/lib/…
+CapabilityBoundingSet=~CAP_SYS_ADMIN
+SystemCallFilter=~@mount,~@swap,~@setuid,~@resources,~@reboot,~@privileged,~@obsolete,~@module
+</file>
+<file txt>
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectedControlGroups=true
+PrivateTmp=true
+PrivateDevices=true
+SystemCallFilter=~@mount,~@swap,~@setuid,~@resources,~@reboot,~@privileged,~@obsolete,~@module,~@keyring,~@cpu-emulation,~@clock,~@chown
+RestrictAddressFamilies=AF_UNIX,AF_INET,AF_INET6
+RestrictNamespaces=true
+RestrictRealtime=true
+#PrivateUsers=
+#MemoryDenyWriteExecute=
+#IPAddressAllow=
+#IPAddressDeny=
+#AmbientCapabilitySet=
+</file>
+Für lokale Dienste (systlog ohne netzwerk, cron (falls keine Jobs auf das Netzwerk zugreifen sollen), ...) zusätzlich:
+<file txt>
+PrivateNetwork=true
+RestrictAddressFamilies=AF_UNIX
+</file>
+TODO: Für Dienste, die keine Daten dauerhaft speichern (ntpd? unbound?):
+<file txt>
+DynamicUser=yes
+User=unbound
+Group=unbound
 </file>