From a6d1ae443e4e613008b2b349bdbb49591cbc1626 Mon Sep 17 00:00:00 2001 From: nico Date: Wed, 10 Jun 2020 12:00:12 +0200 Subject: systemd service hardening + add systemd protective features to restrict the system access + add service documentation link + add service required / after fields --- contrib/init/linux-systemd/ejabberd-cleanup.service | 9 +++++++++ contrib/init/linux-systemd/ejabberd-exporter.service | 10 ++++++++++ contrib/init/linux-systemd/ejabberd-influxdb.service | 10 ++++++++++ 3 files changed, 29 insertions(+) (limited to 'contrib/init') diff --git a/contrib/init/linux-systemd/ejabberd-cleanup.service b/contrib/init/linux-systemd/ejabberd-cleanup.service index 4bea474..ea608d5 100644 --- a/contrib/init/linux-systemd/ejabberd-cleanup.service +++ b/contrib/init/linux-systemd/ejabberd-cleanup.service @@ -1,5 +1,7 @@ [Unit] Description=Clean up ejabberd +Documentation=https://dev.sum7.eu/sum7/ejabberd-tools/-/blob/master/README.md +Requires=ejabberd.service [Service] Type=oneshot @@ -8,6 +10,13 @@ Group=nobody Environment="PATH=/opt/ejabberd-tools/venv/bin:/usr/local/bin:/usr/bin:/bin" ExecStart=/opt/ejabberd-tools/cleanup.py WorkingDirectory=/opt/ejabberd-tools/ +PrivateDevices=true +ProtectControlGroups=true +ProtectHome=true +ProtectKernelTunables=true +ProtectKernelModules=yes +ProtectSystem=full +NoNewPrivileges=yes [Install] WantedBy=multi-user.target diff --git a/contrib/init/linux-systemd/ejabberd-exporter.service b/contrib/init/linux-systemd/ejabberd-exporter.service index 1c0d9e0..1aa06cd 100644 --- a/contrib/init/linux-systemd/ejabberd-exporter.service +++ b/contrib/init/linux-systemd/ejabberd-exporter.service @@ -1,5 +1,8 @@ [Unit] Description=ejabberd prometheus exporter +Documentation=https://dev.sum7.eu/sum7/ejabberd-tools/-/blob/master/README.md +After=prometheus.service +Requires=ejabberd.service prometheus.service [Service] Type=simple @@ -8,6 +11,13 @@ Group=nobody Environment="PATH=/opt/ejabberd-tools/venv/bin:/usr/local/bin:/usr/bin:/bin" ExecStart=/opt/ejabberd-tools/prometheus.py WorkingDirectory=/opt/ejabberd-tools/ +PrivateDevices=true +ProtectControlGroups=true +ProtectHome=true +ProtectKernelTunables=true +ProtectKernelModules=yes +ProtectSystem=full +NoNewPrivileges=yes Restart=always RestartSec=5s diff --git a/contrib/init/linux-systemd/ejabberd-influxdb.service b/contrib/init/linux-systemd/ejabberd-influxdb.service index 364b574..6b711b6 100644 --- a/contrib/init/linux-systemd/ejabberd-influxdb.service +++ b/contrib/init/linux-systemd/ejabberd-influxdb.service @@ -1,5 +1,8 @@ [Unit] Description=ejabberd influxdb exporter +Documentation=https://dev.sum7.eu/sum7/ejabberd-tools/-/blob/master/README.md +After=influxdb.service +Requires=ejabberd.service influxdb.service [Service] Type=simple @@ -8,6 +11,13 @@ Group=nogroup Environment="PATH=/opt/ejabberd-tools/venv/bin:/usr/local/bin:/usr/bin:/bin" ExecStart=/opt/ejabberd-tools/influx.py WorkingDirectory=/opt/ejabberd-tools/ +PrivateDevices=true +ProtectControlGroups=true +ProtectHome=true +ProtectKernelTunables=true +ProtectKernelModules=yes +ProtectSystem=full +NoNewPrivileges=yes Restart=always RestartSec=5s -- cgit v1.2.3-54-g00ecf