A service with least privilege

Articles

• useradd — create a user — The useradd command creates a user account with a home directory, shell, groups and UID; passwd sets the password.
• Special permission bits: setuid, setgid, sticky — Special permission bits: setuid and setgid run a program as its owner; setgid and sticky shape shared directories.
• Capabilities: root split into parts — Root's rights split by the kernel into parts: CAP_NET_BIND_SERVICE for a port below 1024, CAP_DAC_OVERRIDE to bypass file permissions. A process or a file (setcap) gets only the part it needs instead of all of root.
• Service hardening: User=, ProtectSystem, NoNewPrivileges — Unit settings that take extra rights away from a service: User= instead of root, ProtectSystem= (a read-only system), NoNewPrivileges=, CapabilityBoundingSet=. systemd-analyze security rates how exposed the service is.
• systemd — System and service manager that manages units and their dependencies.
• systemctl — managing systemd services — Command for managing systemd units and inspecting their state.