Every service has a security score
Systemd can score how much of the machine a service could reach if it were compromised, and on a stock install most units come back UNSAFE. Asking about a single service prints every available protection one per line and marks the ones that are switched off - here ssh scores 9.6, where a higher number means more exposure. Two of those switches, NoNewPrivileges and PrivateTmp, can be read directly and both return no. None of this is a misconfiguration: these protections are simply not the default, which is exactly why the marked list works as a hardening checklist rather than an alert. Note this is systemd-analyze security, which scores exposure, not systemd-analyze verify, which only checks unit syntax.
Every service on your machine has a security score. Most of them fail.
You harden the application, then forget the unit file that starts it. The service still runs with the whole filesystem in reach and no restrictions at all.
The system manager can score every unit it knows about, and most of them come back unsafe.
Ask it about a single service and it prints every available protection, one per line, marking the ones that are switched off.
The ssh service here scores nine point six, and on this scale higher is worse.
Two of those switches you can check directly. Both are off. Neither is a bug. They are simply not the default, which is what makes that marked list a hardening checklist rather than an alert.
Score one service today, and read the lines that are marked.
#linux#security#selfhosted#devops#sysadmin
❯ Score one service today, and read the lines that are marked.