Secure iperf3 systemd service

[hykilpikonna]

PLEASE NOTE the following text from the iperf3 license. Submitting a
pull request to the iperf3 repository constitutes "[making]
Enhancements available...publicly":

You are under no obligation whatsoever to provide any bug fixes, patches, or
upgrades to the features, functionality or performance of the source code
("Enhancements") to anyone; however, if you choose to make your Enhancements
available either publicly, or directly to Lawrence Berkeley National
Laboratory, without imposing a separate written license agreement for such
Enhancements, then you hereby grant the following license: a non-exclusive,
royalty-free perpetual license to install, use, modify, prepare derivative
works, incorporate into other computer software, distribute, and sublicense
such enhancements or derivative works thereof, in binary and source code form.

The complete iperf3 license is available in the LICENSE file in the
top directory of the iperf3 source tree.

• Version of iperf3 (or development branch, such as master or
  3.1-STABLE) to which this pull request applies: master

Issues fixed (if any):

This pull request improves the security posture of the iperf3 systemd service by introducing additional systemd hardening options. These changes restrict privileges, isolate resources, and mitigate potential attack vectors.

Brief description of code changes (suitable for use as a commit message):

• Added User=nobody to run iperf3 with minimal privileges.
• Enabled systemd sandboxing features:
  • NoNewPrivileges=yes – Prevents privilege escalation.
  • PrivateTmp=yes – Isolates /tmp and /var/tmp to prevent interference.
  • PrivateDevices=yes and DevicePolicy=closed – Restricts access to device files.
  • ProtectSystem=strict – Makes the filesystem read-only except for essential directories.
  • ProtectHome=read-only – Prevents modification of user home directories.
  • ProtectControlGroups=yes, ProtectKernelModules=yes, ProtectKernelTunables=yes – Restricts access to kernel-related settings.
  • RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK – Limits allowed network families.
  • RestrictNamespaces=yes – Disables namespace usage to prevent container escape vulnerabilities.
  • RestrictRealtime=yes and RestrictSUIDSGID=yes – Prevents real-time scheduling abuse and SUID/SGID privilege escalation.
  • MemoryDenyWriteExecute=yes – Blocks execution of writable memory.
  • LockPersonality=yes – Prevents personality changes to avoid exploits.

[johslarsen]

Thank you for suggesting this change. This should definitely be merged. Works on my setup, and I will override my services with this until it (or something similar) makes it upstream.

Iperf is one of those services that is useful to have exposed to the internet as a testing endpoint, and it is a really bad idea that the easiest way to deploy such a service runs as root with full privileges.

[bmah888]

Thanks for the PR! We'll take a look. The use of iperf3 as a systemd service is not one of our primary use cases, but these changes look pretty reasonable at first glimpse.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

User=nobody will cause the unit to fail to start on systems where that account/group is absent, and it also uses a widely shared identity (less isolation between services). Consider switching to DynamicUser=yes (preferred for sandboxed services) or documenting/creating a dedicated iperf3 system user (and optionally set Group= explicitly).

Suggested change

	User=nobody
	DynamicUser=yes

[swlars]

We tested with systemd-analyze security iperf3 and it was still a Medium. This seems like a good change and didn't break anything during some testing. Thanks for the merge request!