bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
|
638
by Teddy Hogeborn
Add systemd service support for Mandos server. |
1 |
[Unit]
|
2 |
Description=Server of encrypted passwords to Mandos clients |
|
|
734
by Teddy Hogeborn
* mandos.service ([Unit]/Documentation): New. |
3 |
Documentation=man:intro(8mandos) man:mandos(8) |
|
787
by Teddy Hogeborn
Depend on Avahi and the network in the server's systemd service file. |
4 |
## If the server is configured to listen to a specific IP or network
|
5 |
## interface, it may be necessary to change "network.target" to
|
|
6 |
## "network-online.target".
|
|
7 |
After=network.target |
|
8 |
## If the server is configured to not use ZeroConf, these two lines
|
|
9 |
## become unnecessary and should be removed or commented out.
|
|
10 |
After=avahi-daemon.service |
|
|
887
by Teddy Hogeborn
"RequisiteOverridable" is deprecated in systemd unit files |
11 |
Requisite=avahi-daemon.service |
|
638
by Teddy Hogeborn
Add systemd service support for Mandos server. |
12 |
|
13 |
[Service]
|
|
|
787
by Teddy Hogeborn
Depend on Avahi and the network in the server's systemd service file. |
14 |
## If the server's D-Bus interface is disabled, the "BusName" setting
|
15 |
## should be removed or commented out.
|
|
|
761
by Teddy Hogeborn
mandos.service: Use Type=dbus (implicitly). |
16 |
BusName=se.recompile.Mandos |
|
638
by Teddy Hogeborn
Add systemd service support for Mandos server. |
17 |
ExecStart=/usr/sbin/mandos --foreground |
18 |
Restart=always |
|
|
757
by Teddy Hogeborn
mandos.service ([Service]/KillMode): Changed to "mixed". |
19 |
KillMode=mixed |
|
761
by Teddy Hogeborn
mandos.service: Use Type=dbus (implicitly). |
20 |
## Using socket activation won't work, because systemd always does
|
21 |
## bind() on the socket, and also won't announce the ZeroConf service.
|
|
|
638
by Teddy Hogeborn
Add systemd service support for Mandos server. |
22 |
#ExecStart=/usr/sbin/mandos --foreground --socket=0
|
23 |
#StandardInput=socket
|
|
|
818
by Teddy Hogeborn
Restrict the Mandos server daemon in the systemd service file. |
24 |
# Restrict what the Mandos daemon can do. Note that this also affects
|
25 |
# "checker" programs!
|
|
26 |
PrivateTmp=yes |
|
27 |
PrivateDevices=yes |
|
28 |
ProtectSystem=full |
|
29 |
ProtectHome=yes |
|
|
825
by Teddy Hogeborn
Server bug fix: Include CAP_SETGID so it does not run as root |
30 |
CapabilityBoundingSet=CAP_KILL CAP_SETGID CAP_SETUID CAP_DAC_OVERRIDE CAP_NET_RAW |
|
905
by Teddy Hogeborn
Add some more restrictions to the systemd service file. |
31 |
ProtectKernelTunables=yes |
32 |
ProtectControlGroups=yes |
|
|
638
by Teddy Hogeborn
Add systemd service support for Mandos server. |
33 |
|
34 |
[Install]
|
|
35 |
WantedBy=multi-user.target |