Hardening the Pyra (by hardening systemd services). Intended audience: Linux intermediate

[FBnil]

The Pyra, which has a modified build based on Debian, has systemd.
The Linux Journal, now resurrected, has a nice article about hardening your Linux Installation.

Systemd Service Hardening | Linux Journal

www.linuxjournal.com

Basically you can run the following command to check what the OS thinks about it's services (you do not need to be root to run this command):

root@pyra:~# systemd-analyze security

Then you can edit a single service:

root@pyra:~# systemctl edit --full $servicename

and you can re-check with:

root@pyra:~# systemd-analyze verify $servicename

Note that there could be old-style services in /etc/init.d/ too; those, if there, need to be handled differently.

If you are not root, put the word "sudo" in front of the command to run it as root. It will ask you your password.


The article comes with an ansible demo. And although you might not be able to run it, the readme tells us a whole lot about what to check for and how to harden services (by adding sandboxing settings, and then re-checking your service):

GitHub - alegrey91/systemd-service-hardening: Basic guide to harden systemd services

Basic guide to harden systemd services. Contribute to alegrey91/systemd-service-hardening development by creating an account on GitHub.

github.com

Next time, we will be talking about open ports and Dutch Tulips (tulpen)

root@pyra:~# netstat -tulpn

and established connections:

root@pyra:~# netstat -tuwpn

Disclaimer: I do not have my Pyra yet, so I can't check the correct working of the commands posted in this post. But I'm on a Debian system.

 

[Djoga'Ro]

I thought, one hardens systemD by preventing it from being run - ideally by not having it installed. ?

 

[netcat]

Two days ago a hacker gained control of my account and listened to Sting on Spotify.

 

[Phlyra]

Awesome stuff, though to expand upon what @Djoga'Ro wrote, what alternatives to systemd might there be for Pyra users?

 

[levi]

I normally periodically test what ports my compter has open using nmap from my server computer to my local computer. It normally reports no ports are open, but 'systemd-analyse security' reports auditd is exposed and others are unsafe. There is a theory that you need to protect your computer from malicious programs running on that computer, including javascripting run on the browser, but that's why I restrict heavily the amount of javascript I run, and then rely on edge protection in the main.

 

[Djoga'Ro]

Awesome stuff, though to expand upon what @Djoga'Ro wrote, what alternatives to systemd might there be for Pyra users?

I wonder how hard it would be to get Devuan running on the Pyra. The kernel doesn't depend on systemd, yet. Right?

I don't know, virtually every Linux desktop or server or handheld having the same huge attack surface just doesn't feel right to me. But that's only part of my concern.
I think everyone who gets an unpleasant feeling thinking about one-party governments or economic monopolies or similar things, should at least want alternatives to exist and be readily intercheangable, even if they themselves are happy to use systemd - as long as it seems to behave in their eyes. ?

I think userland needs globally agreed upon interface and functionality definitions. Then a package could define "I depend on having a sound server xy interface implementation to talk to" or "there must be a session manager for me to make sense" or "I do implement interface foo", instead of "I only come to you party, when Kevin is there, too." - "Susan will be there and I like her better than Kevin." - "I want Kevin!"

 

[Phlyra]

I wonder how hard it would be to get Devuan running on the Pyra. The kernel doesn't depend on systemd, yet. Right?

I don't know, virtually every Linux desktop or server or handheld having the same huge attack surface just doesn't feel right to me. But that's only part of my concern.
I think everyone who gets an unpleasant feeling thinking about one-party governments or economic monopolies or similar things, should at least want alternatives to exist and be readily intercheangable, even if they themselves are happy to use systemd - as long as it seems to behave in their eyes. ?

I think userland needs globally agreed upon interface and functionality definitions. Then a package could define "I depend on having a sound server xy interface implementation to talk to" or "there must be a session manager for me to make sense" or "I do implement interface foo", instead of "I only come to you party, when Kevin is there, too." - "Susan will be there and I like her better than Kevin." - "I want Kevin!"

Are you offering to port Devuan?

 

[Djoga'Ro]

Spoiler: I realize this is rather off-topic, so spoiler-wall:

Are you offering to port Devuan?

Nah, I lack to much in skill for such an attempt. I'm using it on my PC, after I used Void for years (but which I never properly set up in every aspect) and since I read strange things about some heated debates between it's creator and it's community and the departure of the former. (Not that I would mind going back right now, but I'm lazy.)
On my laptop from work, I first installed Devuan, but hoping for better hw support I installed Artix, too, which I stuck with so far. (Still, I'm lazy.)

Devuan seems ok and I'd prefer it to Debian, but it doesn't peak my interest that much. Our lambda - I think it was - said Nix was the shit. So I looked into that, which led to GNU Guix. Now I'm most interested in Guix and' like to put that third on my PC's SSD, but I'd like to Gobo-fy it and use Arcan-fe on top of that. I fear I have a disposition to bite off more than I can chew. But maybe, one day, I'll not only look at the things, but actually try to use 'em.

 

[TrashyMG]

Just smash a Devuan armhf image with a letux kernel shouldn't be too hard.