Florian Bobin f-bn

security and hardening options for systemd service units

A common and reliable pattern in service unit files is thus:

NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict

start new:

tmux

start new with session name:

tmux new -s myname

	#!/bin/bash

	mkdir -p ~/.ssh

	# generate new personal ed25519 ssh keys
	ssh-keygen -o -a 100 -t ed25519 -f ~/.ssh/id_ed25519 -C "rob thijssen <[email protected]>"
	ssh-keygen -o -a 100 -t ed25519 -f ~/.ssh/id_robtn -C "rob thijssen <[email protected]>"

	# generate new host cert authority (host_ca) ed25519 ssh key
	# used for signing host keys and creating host certs