Linux Labs
Linux Labs
EN

Server security / Stage 7 of 10

A service with least privilege

Not running Starting usually ~20 s
Leave the lesson

Step 1 of 6 · on a machine · 5 min

The service asks for more than it needs

What you will learn

  • Run a service under a separate account with User= in a drop-in and check it on the process.
  • Take away a service's access to the filesystem and privilege escalation with ProtectSystem, ProtectHome, NoNewPrivileges.
  • Judge a service's restrictions with systemd-analyze security and grant a service one capability instead of root's powers.

The lab-preview service serves reports from /srv/reports over the network. It was installed as is, and at start it writes a self-check to the journal: who it runs as and what it can reach. Read that line, then look at the service's score.

Exercise · look

See who lab-preview runs as

Read the self-check line in the lab-preview journal, then its score from systemd-analyze security.

First, predict

lab-preview serves ready-made reports over the network. Which user did systemd start it as?

Now start the exercise, run the command and compare your prediction with the output.

Sign in and start The machine is available after signing in
Check yourself 1 question

The lab-preview service runs as root and reads /etc/shadow. Why did systemd start it that way?

  • Port 8095 is above 1024 — any user can open it. Check: the same program as an ordinary user listens on it too.

  • Some image services run as their own users. systemctl show -p User postgresql shows a non-root one.

  • The report files are 644, readable by anyone: ls -l /srv/reports. The service did not get root because of them.

The unit has no User=, so the service ended up as root with all of root's powers.

Found an inaccuracy? Report an error in the lesson

Ubuntu 24.04
Loading…