michael
24bd94dec4
- Add ProtectSystem=strict for read-only filesystem - Add ReadWritePaths for required directories - Add ProtectHome=yes to block home access - Add NoNewPrivileges=yes to prevent escalation - Add PrivateTmp=yes for isolated temp space - Add RestrictAddressFamilies=AF_INET for IPv4-only Related DAW/furt#110
33 lines
612 B
Desktop File
33 lines
612 B
Desktop File
[Unit]
|
|
Description=furt Multi-Tenant API Gateway (Security-Hardened)
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=forking
|
|
User=furt
|
|
Group=furt
|
|
ExecStart=/usr/local/share/furt/scripts/start.sh
|
|
PIDFile=/var/run/furt/furt.pid
|
|
WorkingDirectory=/usr/local/share/furt
|
|
Restart=always
|
|
RestartSec=5
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
|
|
# === SECURITY HARDENING ===
|
|
|
|
# Filesystem Protection
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/var/run/furt /var/log/furt
|
|
ProtectHome=yes
|
|
|
|
# Process Hardening
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
|
|
# Network Restriction
|
|
RestrictAddressFamilies=AF_INET
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
|