From 1842e4f8f2be20f5fead7ae2bf3a333fcdd9f81b Mon Sep 17 00:00:00 2001
From: Denis Chevalier <perso@denischevalier.fr>
Date: Thu, 6 Aug 2026 13:37:24 +0200
Subject: change systemd override installation

---
 etc.bash                                           | 47 ++--------------------
 etc/systemd/system/cups.service.d/override.conf    | 12 ++++++
 .../system/fail2ban.service.d/override.conf        | 11 +++++
 etc/systemd/system/sshd.service.d/override.conf    | 14 +++++++
 4 files changed, 40 insertions(+), 44 deletions(-)
 create mode 100644 etc/systemd/system/cups.service.d/override.conf
 create mode 100644 etc/systemd/system/fail2ban.service.d/override.conf
 create mode 100644 etc/systemd/system/sshd.service.d/override.conf

diff --git a/etc.bash b/etc.bash
index d3082cd..4bbf093 100755
--- a/etc.bash
+++ b/etc.bash
@@ -44,54 +44,13 @@ sudo mkdir -p /etc/systemd/system/fail2ban.service.d
 sudo mkdir -p /etc/systemd/system/cups.service.d
 
 echo "==> Applying sshd.service hardening..."
-sudo bash -c "cat << 'EOF' > /etc/systemd/system/sshd.service.d/override.conf
-[Service]
-NoNewPrivileges=yes
-ProtectSystem=strict
-ProtectHome=read-only
-RuntimeDirectory=sshd
-ReadWritePaths=/var/empty
-PrivateTmp=yes
-ProtectKernelTunables=yes
-ProtectKernelModules=yes
-ProtectControlGroups=yes
-PrivateDevices=yes
-RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
-RestrictRealtime=yes
-LockPersonality=yes
-EOF
-"
+sudo cp -v ./etc/systemd/system/sshd.service.d/override.conf /etc/systemd/system/sshd.service.d/
 
 echo "==> Applying fail2ban.service hardening..."
-sudo bash -c "cat << 'EOF' > /etc/systemd/system/fail2ban.service.d/override.conf
-[Service]
-NoNewPrivileges=yes
-ProtectSystem=full
-PrivateTmp=yes
-ProtectKernelTunables=yes
-ProtectKernelModules=yes
-ProtectControlGroups=yes
-PrivateDevices=yes
-RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
-RestrictRealtime=yes
-EOF
-"
+sudo cp -v ./etc/systemd/system/fail2ban.service.d/override.conf /etc/systemd/system/fail2ban.service.d/
 
 echo "==> Applying cups.service hardening..."
-sudo bash -c "cat << 'EOF' > /etc/systemd/system/cups.service.d/override.conf
-[Service]
-NoNewPrivileges=yes
-ProtectSystem=strict
-ProtectHome=yes
-ReadWritePaths=/var/spool/cups /var/cache/cups /var/run/cups /etc/cups
-PrivateTmp=yes
-ProtectKernelTunables=yes
-ProtectKernelModules=yes
-ProtectControlGroups=yes
-RestrictNamespaces=yes
-MemoryDenyWriteExecute=yes
-EOF
-"
+sudo cp -v ./etc/systemd/system/cups.service.d/override.conf /etc/systemd/system/cups.service.d/
 
 sudo systemctl daemon-reload
 
diff --git a/etc/systemd/system/cups.service.d/override.conf b/etc/systemd/system/cups.service.d/override.conf
new file mode 100644
index 0000000..d12b406
--- /dev/null
+++ b/etc/systemd/system/cups.service.d/override.conf
@@ -0,0 +1,12 @@
+[Service]
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths=/var/spool/cups /var/cache/cups /var/run/cups /etc/cups
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictNamespaces=yes
+MemoryDenyWriteExecute=yes
+
diff --git a/etc/systemd/system/fail2ban.service.d/override.conf b/etc/systemd/system/fail2ban.service.d/override.conf
new file mode 100644
index 0000000..f897711
--- /dev/null
+++ b/etc/systemd/system/fail2ban.service.d/override.conf
@@ -0,0 +1,11 @@
+[Service]
+NoNewPrivileges=yes
+ProtectSystem=full
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictRealtime=yes
+
diff --git a/etc/systemd/system/sshd.service.d/override.conf b/etc/systemd/system/sshd.service.d/override.conf
new file mode 100644
index 0000000..415a729
--- /dev/null
+++ b/etc/systemd/system/sshd.service.d/override.conf
@@ -0,0 +1,14 @@
+[Service]
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=read-only
+RuntimeDirectory=sshd
+ReadWritePaths=/var/empty
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictRealtime=yes
+LockPersonality=yes
-- 
cgit