Systemd security

The systemd units can also provide an extra layer of security. You can add several options to your unit file to make your unit more secure.

Just edit the unit file using systemctl --edit and add the security measures. For instance, execute the following:

sudo systemctl --edit sshd

Add the following lines:

[Service]
ProtectHome=read-only

Save the file, reread the systemctl configuration, and restart sshd:

sudo systemctl daemon-reload

sudo systemctl restart sshd

Now log in again with your SSH client and try to save a file in your home. It will fail because it's a read-only filesystem:

Restricting access to the filesystem

The ProtectHome parameter is a very interesting one. The following values are available:

• true: The directories /home, /root, and /run/user are not accessible by the unit, and show empty for processes starting within the unit
• read-only: These directories are read-only

Another very similar parameter is ProtectSystem:

• true: /usr and /boot are mounted read-only.
• full: Same...