Add hardened systemd service

Fix owenthereal#112
exploshot · Mar 6, 2022 · 4ab9a1e · 4ab9a1e
1 parent fb5124e
commit 4ab9a1e
Showing 2 changed files with 39 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -234,6 +234,17 @@ TF_VAR_uptermd_host_keys_dir=PATH_TO_HOST_KEYS \
 bin/do-install
 ```
 
+### systemd
+
+A hardened systemd service is provided in `systemd/uptermd.service`. You can use it to easily run a
+secured `uptermd` on your machine:
+
+```
+cp systemd/uptermd.service /etc/systemd/system/uptermd.service
+systemctl daemon-reload
+systemctl start uptermd
+```
+
 ## How is Upterm compared to prior arts?
 
 Upterm is an alternative to [Tmate](https://tmate.io).

diff --git a/systemd/uptermd.service b/systemd/uptermd.service
@@ -0,0 +1,28 @@
+[Unit]
+Description=upterm secure terminal sharing
+After=network-online.target
+Wants=network-online.target systemd-networkd-wait-online.service
+
+[Service]
+ExecStart=/usr/bin/uptermd --ssh-addr 0.0.0.0:2222
+
+IPAccounting=yes
+IPAddressAllow=localhost
+IPAddressDeny=any
+DynamicUser=yes
+PrivateTmp=yes
+PrivateUsers=yes
+PrivateDevices=yes
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=yes
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target