From b19df97630ef273342d853a7658285f222f330b6 Mon Sep 17 00:00:00 2001
From: Denis Chevalier <perso@denischevalier.fr>
Date: Thu, 6 Aug 2026 13:14:06 +0200
Subject: harden systemd services

---
 etc.bash | 67 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 67 insertions(+)

diff --git a/etc.bash b/etc.bash
index 80a9310..34a2894 100755
--- a/etc.bash
+++ b/etc.bash
@@ -35,3 +35,70 @@ sudo systemctl enable --now fstrim.timer
 # linux-hardened
 sudo cp -v ./etc/mkinitcpio.d/linux-hardened.preset /etc/mkinitcpio.d
 sudo mkinitcpio -P
+
+# harden systemd services
+echo "==> Creating drop-in override directories..."
+sudo mkdir -p /etc/systemd/system/sshd.service.d
+sudo mkdir -p /etc/systemd/system/fail2ban.service.d
+sudo mkdir -p /etc/systemd/system/cups.service.d
+
+echo "==> Applying sshd.service hardening..."
+sudo bash -c "cat << 'EOF' > /etc/systemd/system/sshd.service.d/override.conf
+[Service]
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=read-only
+ReadWritePaths=/var/empty /run/sshd
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictRealtime=yes
+LockPersonality=yes
+EOF
+"
+
+echo "==> Applying fail2ban.service hardening..."
+sudo bash -c "cat << 'EOF' > /etc/systemd/system/fail2ban.service.d/override.conf
+[Service]
+NoNewPrivileges=yes
+ProtectSystem=full
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictRealtime=yes
+EOF
+"
+
+echo "==> Applying cups.service hardening..."
+sudo bash -c "cat << 'EOF' > /etc/systemd/system/cups.service.d/override.conf
+[Service]
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths=/var/spool/cups /var/cache/cups /var/run/cups /etc/cups
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictNamespaces=yes
+MemoryDenyWriteExecute=yes
+EOF
+"
+
+sudo systemctl daemon-reload
+
+echo "==> Restarting services..."
+for svc in sshd fail2ban cups; do
+    if systemctl is-active --quiet "$svc"; then
+        echo "  Restarting active service: $svc"
+        sudo systemctl restart "$svc"
+    else
+        echo "  Skipping restart for inactive service: $svc"
+    fi
+done
-- 
cgit