Why not set a non-privileged user in systemd unit file? about endlessh HOT 5 CLOSED

systemd/systemd@bed0b7d

This is not safe. The [nobody] user's main purpose on Linux-based
operating systems is to be the owner of files that otherwise cannot be mapped
to any local user. It's used by the NFS client and Linux user namespacing,
among others. By running a unit's processes under the identity of this user
they might possibly get read and even write access to such files that cannot
otherwise be mapped.

It is strongly recommended to avoid running services under this user identity,
in particular on systems using NFS or running containers. Allocate a user ID
specific to this service, either statically via systemd-sysusers or dynamically
via the DynamicUser= service setting.

from endlessh.

For me the following service configuration works:

[Unit]
Description=Endlessh SSH Tarpit
Documentation=man:endlessh(1)
Requires=network-online.target

[Service]
Type=simple
Restart=always
RestartSec=30sec
ExecStart=/usr/bin/endlessh
KillSignal=SIGTERM

# Stop trying to restart the service if it restarts too many times in a row
StartLimitInterval=5min
StartLimitBurst=4

StandardOutput=journal
StandardError=journal
StandardInput=null

PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true

PrivateUsers=true
DynamicUser=true

NoNewPrivileges=true
ConfigurationDirectory=endlessh
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
ProtectClock=true
ProtectKernelLogs=true
ProtectProc=true
ProtectHostname=true
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictRealtime=true

SystemCallFilter=@system-service

[Install]
WantedBy=multi-user.target

from endlessh.

Good point - but it should not left as it is as it's currently root

from endlessh.

I mean, it looks to me that "nobody" was chosen as an example... couldn't we just make an "endlessh" user for this?

That way if some exploit does make it's way out, they'll have access to that user instead of root, which is the whole point of this suggestion(IMHO).

from endlessh.

closing

from endlessh.