For Teachers · Back to the Module · Print with your browser's Print command.

P11 Worksheet: Service Hardening With systemd

Student Worksheet (about 25 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P1

Learning Objectives

• [ ] Read a systemd unit file and its drop-ins and know which settings win.
• [ ] Explain why a service's user, program location and unit file permissions decide what an attacker gains.
• [ ] Apply basic sandboxing settings and keep secrets out of unit files.

Key Terms

Write each definition in your own words.

• Service Unit: ______________________________________________
• Sandboxing: ______________________________________________
• Least Privilege: ______________________________________________
• Privilege Escalation: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only HOST-SYSD- --out p11 and list, for each vulnerable unit, the line you would add or change.
2. Compare the shop-api.service unit in the vulnerable and hardened labs (internal/lab/fixtures_stacks.go) setting by setting.
3. On a test machine: systemd-analyze security and pick the service with the worst score; add NoNewPrivileges=yes with systemctl edit and re-run.

Self-Check Questions

1. A system service unit has no User= line. Which account runs the service?

• [ ] a) nobody
• [ ] b) root
• [ ] c) the user who installed it
• [ ] d) a dynamic user

1. Why is a world-writable unit file dangerous?

• [ ] a) It wastes disk space
• [ ] b) Any user can change ExecStart= and have their program run as root
• [ ] c) systemd refuses to start it
• [ ] d) It slows down boot

1. Where should a service's database password go?

• [ ] a) Environment= in the unit file
• [ ] b) A root-only EnvironmentFile= or a systemd credential
• [ ] c) The service's Description=
• [ ] d) A comment in the unit file

1. What does ProtectSystem=strict do?

• [ ] a) Mounts the operating system read-only for the service
• [ ] b) Blocks network access
• [ ] c) Gives the service its own /tmp
• [ ] d) Runs the service as nobody

1. A unit file and a drop-in in <name>.service.d/ set the same option differently. Which value normally applies?

• [ ] a) The unit file's
• [ ] b) The drop-in's, because drop-ins are applied after the unit file
• [ ] c) Whichever file is larger
• [ ] d) Neither, because systemd refuses to start the unit

1. Which command scores how exposed a unit is?

• [ ] a) systemctl status
• [ ] b) systemd-analyze security
• [ ] c) journalctl -u
• [ ] d) ss -tlnp

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• systemd.exec(5): https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html
• systemd, System and Service Credentials: https://systemd.io/CREDENTIALS/
• MITRE ATT&CK T1543.002, Systemd Service: https://attack.mitre.org/techniques/T1543/002/

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.