Introduce systemd.exec restrictions for better security

2018-12-07 21:54:44 +01:00
parent 8e155012a7
commit 4f6539b31d
8 changed files with 120 additions and 0 deletions
--- a/etc/systemd/system/vsftpd.service.d/custom.conf
+++ b/etc/systemd/system/vsftpd.service.d/custom.conf
@ -0,0 +1,13 @@
+[Service]
+ProtectSystem=strict
+PrivateTmp=true
+NoNewPrivileges=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+SystemCallArchitectures=native
+InaccessiblePaths=/var/www/
+InaccessiblePaths=/root/