fripost-ansible/roles/common/files/etc/systemd/system, branch master Fripost ansible scripts Improve Debian 11's fail2ban rules. 2022-12-18T12:29:34+00:00 Guilhem Moulin guilhem@fripost.org 2022-12-14T11:01:33+00:00 7ea3baad594b889f6f7f4e7e4ccc4dc7c0099bc6 






Port baseline to Debian 11 (codename Bullseye).
2022-10-13T20:12:05+00:00

Guilhem Moulin
guilhem@fripost.org

2022-10-11T23:43:23+00:00

85347041a04d17f6803100dd2cec9b489c9db47d












Bacula: refactor systemd service files.
2020-11-03T02:37:11+00:00

Guilhem Moulin
guilhem@fripost.org

2020-11-03T02:15:10+00:00

ead9aaa3dd7ca48012b2b21cc930ee73c8eaa9d3

Use unit overrides on top of upstream's service files instead of
overriding entire service files.  In particular, upstream uses flag `-P`
so we don't need to use RuntimeDirectory= anymore.





Use unit overrides on top of upstream's service files instead of
overriding entire service files.  In particular, upstream uses flag `-P`
so we don't need to use RuntimeDirectory= anymore.







stunnel4: Harden and socket-activate.
2020-05-18T13:51:54+00:00

Guilhem Moulin
guilhem@fripost.org

2020-05-18T13:51:54+00:00

42df93debccbcb1a18cd377b6de0b5b20527312f












Upgrade baseline to Debian 10.
2020-05-16T03:45:59+00:00

Guilhem Moulin
guilhem@fripost.org

2020-05-16T00:52:55+00:00

bac7811d2b35252b7a83a45d75bb344b4b1776a9












Improve/harden fail2ban configuration.
2020-01-25T00:57:05+00:00

Guilhem Moulin
guilhem@fripost.org

2020-01-23T04:33:17+00:00

ee4e9e9836ad05279647b04eb1e8a3a4b0e16568

 * Use nftables sets with a timeout
 * Start daemon with a hardened unit file and restricted Capability
   Bounding Set.  (This requires to change the log path to
   /var/log/fail2ban/*.)
 * Skip database as we don't care about persistence.
 * Refactor jail.local





 * Use nftables sets with a timeout
 * Start daemon with a hardened unit file and restricted Capability
   Bounding Set.  (This requires to change the log path to
   /var/log/fail2ban/*.)
 * Skip database as we don't care about persistence.
 * Refactor jail.local







systemd.service: Tighten hardening options.
2018-12-09T19:25:40+00:00

Guilhem Moulin
guilhem@fripost.org

2018-12-09T17:15:10+00:00

2147ff3bd9091b88960e2243b2d7d76d03cadc89












bacula-*.service: Don't fork in the background.
2018-12-09T19:25:39+00:00

Guilhem Moulin
guilhem@fripost.org

2018-12-09T17:12:39+00:00

2845af5f76ad3be9c0a1f69ab478ff5a08346a4c

Inspired from /lib/systemd/system/bacula-fd.service.





Inspired from /lib/systemd/system/bacula-fd.service.







systemd: Replace ‘ProtectSystem=full’ with ‘ProtectSystem=strict’.
2018-12-09T19:25:39+00:00

Guilhem Moulin
guilhem@fripost.org

2018-12-08T00:06:06+00:00

6a57ea01fd48992883d6dac1b7746e79202215e4

And remove ‘ReadOnlyDirectories=/’ as it's implied by ‘ProtectSystem=strict’.





And remove ‘ReadOnlyDirectories=/’ as it's implied by ‘ProtectSystem=strict’.







/lib/systemd/system → /etc/systemd/system
2017-05-31T15:39:57+00:00

Guilhem Moulin
guilhem@fripost.org

2017-05-31T15:39:57+00:00

e136d3edbdb6749d4559939dc9fcbc11d166e34c