Post #3024013

2025-12-24 03:30 UTC

If you want to know more, here's some good places to start in the systemd docs: General hardening: https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#Sandboxing Network filtering: https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html#Network%20Accounting%20and%20Control + honourable mention for SHH, a tool I haven't used but looks interesting, which can automatically generate hardening settings for you by observing what your service actually does at runtime: https://github.com/desbma/shh

Replies (5)

@duncan_bayne@mastodon.bsd.cafe 2025-12-24 04:05

@hailey@hails.org 😉 On a serious note - thanks, this is really interesting. We deploy as systemd units at $DAYJOB already; looks like we could harden things a bit.

Open ##3024015
@avuton@infosec.exchange 2025-12-24 05:23

@hailey@hails.org Shouldn't distros/distributors be shipping units with hardening?

Open ##3024016
@ppxl@social.tchncs.de 2025-12-24 05:32

@hailey@hails.org thanks for the shh mention. I dealed with proprietary systemd services and wasn't aware how much services could be hardened 💪🏾 will deffo look into this

Open ##3024019
@cks@mastodon.social 2025-12-24 19:29

@hailey@hails.org The one gotcha with network hardening that I discovered the hard way is that this also affects name lookups if you're doing DNS queries to off-machine DNS resolvers (which is our standard server configuration at work). Systemd-resolved on the local system can fix that, which is (another) reason to consider using it if you aren't already.

Open ##3024020
@s0@cathode.church 2026-04-30 11:45

@hailey@hails.org these man page links are understandably comprehensive, but leave me with no idea what is actually likely to be useful/necessary in general. Do you know of any good primer or recommendations guide?

Open ##3024021