-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Expand file tree
/
Copy pathmaltrail-server.service
More file actions
72 lines (64 loc) · 2.37 KB
/
Copy pathmaltrail-server.service
File metadata and controls
72 lines (64 loc) · 2.37 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
[Unit]
Description=Maltrail. Server of malicious traffic detection system
Documentation=https://github.com/stamparm/maltrail#readme
Documentation=https://github.com/stamparm/maltrail/wiki
Requires=network.target
Before=maltrail-sensor.service
After=network-online.target
[Service]
Type=exec
# The server does NOT need root: HTTP_PORT (8338) and the sensor intake port (8337/udp) are
# both unprivileged. It runs as the same user as the sensor so both can reach LOG_DIR.
#
# groupadd --system maltrail
# useradd --system --gid maltrail --no-create-home --shell /usr/sbin/nologin maltrail
#
# The groupadd is not optional: Group=maltrail below needs it to exist, and `useradd` only
# creates a matching group on distributions that default to per-user groups.
#
# StateDirectory/LogsDirectory create and chown the rest:
# /var/lib/maltrail the trail set, which the server refreshes too (core/update.py)
# /var/log/maltrail the event logs (LOG_DIR) and meta.sqlite
DynamicUser=no
User=maltrail
Group=maltrail
StateDirectory=maltrail
StateDirectoryMode=0750
LogsDirectory=maltrail
LogsDirectoryMode=0750
# Event logs name internal addresses, domains and URLs. World-readable is the wrong default.
UMask=0027
NoNewPrivileges=yes
CapabilityBoundingSet=
WorkingDirectory=/opt/maltrail
# `maltrail` has no home, and ProtectHome=yes hides one anyway, so the default
# ~/.maltrail/trails.csv is unusable here. Keep the trail set in StateDirectory.
Environment=HOME=/var/lib/maltrail
Environment=PYTHONUNBUFFERED=1
ExecStart=/usr/bin/python3 server.py
Restart=on-failure
RestartSec=5
KillMode=mixed
KillSignal=SIGTERM
TimeoutStopSec=30
# Hardening. None of this restricts what the server legitimately does (listen on HTTP_PORT and
# the UDP intake port, read trails, read and append LOG_DIR).
# To bind a port below 1024 (e.g. HTTP_PORT 443), add:
# AmbientCapabilities=CAP_NET_BIND_SERVICE
# CapabilityBoundingSet=CAP_NET_BIND_SERVICE
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictNamespaces=yes
RestrictRealtime=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
# ProtectSystem=strict makes the filesystem read-only; StateDirectory= and LogsDirectory= are
# writable automatically, so nothing else needs naming here.
[Install]
WantedBy=multi-user.target