systemctl a deeper dive

dos2unix

dos2unix

Well-Known Member
Joined
May 3, 2019
Messages
4,408
Reaction score
4,601
Credits
41,638
Most of us know about
Code: 
systemd-analyze

and

Code: 
systemd-analyze blame

But you can also use other systemd modules.

For example.. how secure do you really think sshd is?
Try this command...

Code: 
systemd-analyze security sshd.service

This gives quite a long list, that might look similar to this.
Code: 
e
  NAME                                                        DESCRIPTION                                                             EXPOSURE
✗ RootDirectory=/RootImage=                                   Service runs within the host's root directory                                0.1
  SupplementaryGroups=                                        Service runs as root, option does not matter                                 
  RemoveIPC=                                                  Service runs as root, option does not apply                                  
✗ User=/DynamicUser=                                          Service runs as root user                                                    0.4
✗ CapabilityBoundingSet=~CAP_SYS_TIME                         Service processes may change the system clock                                0.2
✗ NoNewPrivileges=                                            Service processes may acquire new privileges                                 0.2
✓ AmbientCapabilities=                                        Service process does not receive ambient capabilities                        
✗ PrivateDevices=                                             Service potentially has access to hardware devices                           0.2
✗ ProtectClock=                                               Service may write to the hardware clock or system clock                      0.2
✗ CapabilityBoundingSet=~CAP_SYS_PACCT                        Service may use acct()                                                       0.1
✗ CapabilityBoundingSet=~CAP_KILL                             Service may send UNIX signals to arbitrary processes                         0.1
✗ ProtectKernelLogs=                                          Service may read from or write to the kernel log ring buffer                 0.2
✗ CapabilityBoundingSet=~CAP_WAKE_ALARM                       Service may program timers that wake up the system                           0.1
✗ CapabilityBoundingSet=~CAP_(DAC_*|FOWNER|IPC_OWNER)         Service may override UNIX file/IPC permission checks                         0.2
✗ ProtectControlGroups=                                       Service may modify the control group file system                             0.2
✗ CapabilityBoundingSet=~CAP_LINUX_IMMUTABLE                  Service may mark files immutable                                             0.1
✗ CapabilityBoundingSet=~CAP_IPC_LOCK                         Service may lock memory into RAM                                             0.1
✗ ProtectKernelModules=                                       Service may load or read kernel modules                                      0.2
✗ CapabilityBoundingSet=~CAP_SYS_MODULE                       Service may load kernel modules                                              0.2
✗ CapabilityBoundingSet=~CAP_BPF                              Service may load BPF programs                                                0.1
✗ CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG                   Service may issue vhangup()                                                  0.1
✗ CapabilityBoundingSet=~CAP_SYS_BOOT                         Service may issue reboot()                                                   0.1
✗ CapabilityBoundingSet=~CAP_SYS_CHROOT                       Service may issue chroot()                                                   0.1
✗ PrivateMounts=                                              Service may install system mounts                                            0.2
✗ SystemCallArchitectures=                                    Service may execute system calls with all ABIs                               0.2
✗ CapabilityBoundingSet=~CAP_BLOCK_SUSPEND                    Service may establish wake locks                                             0.1
✗ MemoryDenyWriteExecute=                                     Service may create writable executable memory mappings                       0.1
✗ RestrictNamespaces=~user                                    Service may create user namespaces                                           0.3
✗ RestrictNamespaces=~pid                                     Service may create process namespaces                                        0.1
✗ RestrictNamespaces=~net                                     Service may create network namespaces                                        0.1
✗ RestrictNamespaces=~uts                                     Service may create hostname namespaces                                       0.1
✗ RestrictNamespaces=~mnt                                     Service may create file system namespaces                                    0.1
✗ CapabilityBoundingSet=~CAP_LEASE                            Service may create file leases                                               0.1
✗ CapabilityBoundingSet=~CAP_MKNOD                            Service may create device nodes                                              0.1
✗ RestrictNamespaces=~cgroup                                  Service may create cgroup namespaces                                         0.1
✗ RestrictSUIDSGID=                                           Service may create SUID/SGID files                                           0.2
✗ RestrictNamespaces=~ipc                                     Service may create IPC namespaces                                            0.1
✗ ProtectHostname=                                            Service may change system host/domainname                                    0.1
✗ CapabilityBoundingSet=~CAP_(CHOWN|FSETID|SETFCAP)           Service may change file ownership/access mode/capabilities unrestricted      0.2
✗ CapabilityBoundingSet=~CAP_SET(UID|GID|PCAP)                Service may change UID/GID identities/capabilities                           0.3
✗ LockPersonality=                                            Service may change ABI personality                                           0.1
✗ ProtectKernelTunables=                                      Service may alter kernel tunables                                            0.2
✗ RestrictAddressFamilies=~AF_PACKET                          Service may allocate packet sockets                                          0.2
✗ RestrictAddressFamilies=~AF_NETLINK                         Service may allocate netlink sockets                                         0.1
✗ RestrictAddressFamilies=~AF_UNIX                            Service may allocate local sockets                                           0.1
✗ RestrictAddressFamilies=~…                                  Service may allocate exotic sockets                                          0.3
✗ RestrictAddressFamilies=~AF_(INET|INET6)                    Service may allocate Internet sockets                                        0.3
✗ CapabilityBoundingSet=~CAP_MAC_*                            Service may adjust SMACK MAC                                                 0.1
✗ RestrictRealtime=                                           Service may acquire realtime scheduling                                      0.1
✗ CapabilityBoundingSet=~CAP_SYS_RAWIO                        Service has raw I/O access                                                   0.2
✗ CapabilityBoundingSet=~CAP_SYS_PTRACE                       Service has ptrace() debugging abilities                                     0.3
✗ CapabilityBoundingSet=~CAP_SYS_(NICE|RESOURCE)              Service has privileges to change resource use parameters                     0.1
✗ DeviceAllow=                                                Service has no device ACL                                                    0.2
✗ CapabilityBoundingSet=~CAP_NET_ADMIN                        Service has network configuration privileges                                 0.2
✗ ProtectSystem=                                              Service has full access to the OS file hierarchy                             0.2
✗ ProtectProc=                                                Service has full access to process tree (/proc hidepid=)                     0.2
✗ ProcSubset=                                                 Service has full access to non-process /proc files (/proc subset=)           0.1
✗ ProtectHome=                                                Service has full access to home directories                                  0.2
✗ CapabilityBoundingSet=~CAP_NET_(BIND_SERVICE|BROADCAST|RAW) Service has elevated networking privileges                                   0.1
✗ CapabilityBoundingSet=~CAP_AUDIT_*                          Service has audit subsystem access                                           0.1
✗ CapabilityBoundingSet=~CAP_SYS_ADMIN                        Service has administrator privileges                                         0.3
✗ PrivateNetwork=                                             Service has access to the host's network                                     0.5
✗ PrivateUsers=                                               Service has access to other users                                            0.2
✗ PrivateTmp=                                                 Service has access to other software's temporary files                       0.2
✗ CapabilityBoundingSet=~CAP_SYSLOG                           Service has access to kernel logging                                         0.1
✓ KeyringMode=                                                Service doesn't share key material with other services                       
✓ Delegate=                                                   Service does not maintain its own delegated control group subtree            
✗ SystemCallFilter=~@clock                                    Service does not filter system calls                                         0.2
✗ SystemCallFilter=~@cpu-emulation                            Service does not filter system calls                                         0.1
✗ SystemCallFilter=~@debug                                    Service does not filter system calls                                         0.2
✗ SystemCallFilter=~@module                                   Service does not filter system calls                                         0.2
✗ SystemCallFilter=~@mount                                    Service does not filter system calls                                         0.2
✗ SystemCallFilter=~@obsolete                                 Service does not filter system calls                                         0.1
✗ SystemCallFilter=~@privileged                               Service does not filter system calls                                         0.2
✗ SystemCallFilter=~@raw-io                                   Service does not filter system calls                                         0.2
✗ SystemCallFilter=~@reboot                                   Service does not filter system calls                                         0.2
✗ SystemCallFilter=~@resources                                Service does not filter system calls                                         0.2
✗ SystemCallFilter=~@swap                                     Service does not filter system calls                                         0.2
✗ IPAddressDeny=                                              Service does not define an IP address allow list                             0.2
✓ NotifyAccess=                                               Service child processes cannot alter service state                           
✗ UMask=                                                      Files created by service are world-readable by default                       0.1

→ Overall exposure level for sshd.service: 9.6 UNSAFE

Notice that bottom line. 9.6.. unsafe. This grades your systemd modules (I will include some other examples)
from 0 to 10. 0 is the safest and 10 is the unsafest. 9.6 isn't a very good score.

But there are some things we can do to get a "lower" score (lower is better).

Code: 
sudo mkdir -p /etc/systemd/system/sshd.service.d/

Code: 
sudo nano (or vi) /etc/systemd/system/sshd.service.d/hardening.conf


[Service]
# Kernel protections (sshd doesn't need any of these)
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectKernelTunables=yes
ProtectClock=yes
ProtectControlGroups=yes

# Process protections
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
LockPersonality=yes
RestrictSUIDSGID=yes

# Namespace restrictions
PrivateMounts=yes
PrivateTmp=yes

# Filesystem
ProtectProc=invisible
ProcSubset=pid

# Capability restrictions (safe ones)
CapabilityBoundingSet=~CAP_SYS_MODULE
CapabilityBoundingSet=~CAP_SYS_BOOT
CapabilityBoundingSet=~CAP_SYS_TIME
CapabilityBoundingSet=~CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND
CapabilityBoundingSet=~CAP_LEASE
CapabilityBoundingSet=~CAP_LINUX_IMMUTABLE
CapabilityBoundingSet=~CAP_BPF
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG

rmccaffi@blackTower:~$

That's good enough for now, this isn't a tutorial on all the things the security module checks for.
Go ahead and reload sshd

Code: 
sudo systemd-daemon-reload
sudo systemctl restart sshd

Then run your systemd analyze command again...

Code: 
5
systemd-analyze security sshd.service
  NAME                                                        DESCRIPTION                                                             EXPOSURE
✗ RootDirectory=/RootImage=                                   Service runs within the host's root directory                                0.1
  SupplementaryGroups=                                        Service runs as root, option does not matter                                 
  RemoveIPC=                                                  Service runs as root, option does not apply                                  
✗ User=/DynamicUser=                                          Service runs as root user                                                    0.4
✓ RestrictRealtime=                                           Service realtime scheduling access is restricted                             
✗ NoNewPrivileges=                                            Service processes may acquire new privileges                                 0.2
✓ CapabilityBoundingSet=~CAP_SYS_TIME                         Service processes cannot change the system clock                             
✓ AmbientCapabilities=                                        Service process does not receive ambient capabilities                        
✗ PrivateDevices=                                             Service potentially has access to hardware devices                           0.2
✗ CapabilityBoundingSet=~CAP_SYS_PACCT                        Service may use acct()                                                       0.1
✗ CapabilityBoundingSet=~CAP_KILL                             Service may send UNIX signals to arbitrary processes                         0.1
✗ CapabilityBoundingSet=~CAP_(DAC_*|FOWNER|IPC_OWNER)         Service may override UNIX file/IPC permission checks                         0.2
✓ CapabilityBoundingSet=~CAP_BPF                              Service may not load BPF programs                                            
✗ CapabilityBoundingSet=~CAP_IPC_LOCK                         Service may lock memory into RAM                                             0.1
✗ CapabilityBoundingSet=~CAP_SYS_CHROOT                       Service may issue chroot()                                                   0.1
✗ SystemCallArchitectures=                                    Service may execute system calls with all ABIs                               0.2
✗ RestrictNamespaces=~user                                    Service may create user namespaces                                           0.3
✗ RestrictNamespaces=~pid                                     Service may create process namespaces                                        0.1
✗ RestrictNamespaces=~net                                     Service may create network namespaces                                        0.1
✗ RestrictNamespaces=~uts                                     Service may create hostname namespaces                                       0.1
✗ RestrictNamespaces=~mnt                                     Service may create file system namespaces                                    0.1
✗ CapabilityBoundingSet=~CAP_MKNOD                            Service may create device nodes                                              0.1
✗ RestrictNamespaces=~cgroup                                  Service may create cgroup namespaces                                         0.1
✗ RestrictNamespaces=~ipc                                     Service may create IPC namespaces                                            0.1
✗ ProtectHostname=                                            Service may change system host/domainname                                    0.1
✗ CapabilityBoundingSet=~CAP_(CHOWN|FSETID|SETFCAP)           Service may change file ownership/access mode/capabilities unrestricted      0.2
✗ CapabilityBoundingSet=~CAP_SET(UID|GID|PCAP)                Service may change UID/GID identities/capabilities                           0.3
✗ RestrictAddressFamilies=~AF_PACKET                          Service may allocate packet sockets                                          0.2
✗ RestrictAddressFamilies=~AF_NETLINK                         Service may allocate netlink sockets                                         0.1
✗ RestrictAddressFamilies=~AF_UNIX                            Service may allocate local sockets                                           0.1
✗ RestrictAddressFamilies=~…                                  Service may allocate exotic sockets                                          0.3
✗ RestrictAddressFamilies=~AF_(INET|INET6)                    Service may allocate Internet sockets                                        0.3
✗ CapabilityBoundingSet=~CAP_MAC_*                            Service may adjust SMACK MAC                                                 0.1
✓ ProtectProc=                                                Service has restricted access to process tree (/proc hidepid=)               
✗ CapabilityBoundingSet=~CAP_SYS_RAWIO                        Service has raw I/O access                                                   0.2
✗ CapabilityBoundingSet=~CAP_SYS_PTRACE                       Service has ptrace() debugging abilities                                     0.3
✗ CapabilityBoundingSet=~CAP_SYS_(NICE|RESOURCE)              Service has privileges to change resource use parameters                     0.1
✗ DeviceAllow=                                                Service has no device ACL                                                    0.2
✓ PrivateTmp=                                                 Service has no access to other software's temporary files                    
✓ ProcSubset=                                                 Service has no access to non-process /proc files (/proc subset=)             
✓ CapabilityBoundingSet=~CAP_SYSLOG                           Service has no access to kernel logging                                      
✗ CapabilityBoundingSet=~CAP_NET_ADMIN                        Service has network configuration privileges                                 0.2
✗ ProtectSystem=                                              Service has full access to the OS file hierarchy                             0.2
✗ ProtectHome=                                                Service has full access to home directories                                  0.2
✗ CapabilityBoundingSet=~CAP_NET_(BIND_SERVICE|BROADCAST|RAW) Service has elevated networking privileges                                   0.1
✗ CapabilityBoundingSet=~CAP_AUDIT_*                          Service has audit subsystem access                                           0.1
✗ CapabilityBoundingSet=~CAP_SYS_ADMIN                        Service has administrator privileges                                         0.3
✗ PrivateNetwork=                                             Service has access to the host's network                                     0.5
✗ PrivateUsers=                                               Service has access to other users                                            0.2
✓ KeyringMode=                                                Service doesn't share key material with other services                       
✓ Delegate=                                                   Service does not maintain its own delegated control group subtree            
✗ SystemCallFilter=~@clock                                    Service does not filter system calls                                         0.2
✗ SystemCallFilter=~@cpu-emulation                            Service does not filter system calls                                         0.1
✗ SystemCallFilter=~@debug                                    Service does not filter system calls                                         0.2
✗ SystemCallFilter=~@module                                   Service does not filter system calls                                         0.2
✗ SystemCallFilter=~@mount                                    Service does not filter system calls                                         0.2
✗ SystemCallFilter=~@obsolete                                 Service does not filter system calls                                         0.1
✗ SystemCallFilter=~@privileged                               Service does not filter system calls                                         0.2
✗ SystemCallFilter=~@raw-io                                   Service does not filter system calls                                         0.2
✗ SystemCallFilter=~@reboot                                   Service does not filter system calls                                         0.2
✗ SystemCallFilter=~@resources                                Service does not filter system calls                                         0.2
✗ SystemCallFilter=~@swap                                     Service does not filter system calls                                         0.2
✗ IPAddressDeny=                                              Service does not define an IP address allow list                             0.2
✓ NotifyAccess=                                               Service child processes cannot alter service state                           
✓ ProtectClock=                                               Service cannot write to the hardware clock or system clock                   
✓ ProtectKernelLogs=                                          Service cannot read from or write to the kernel log ring buffer              
✓ CapabilityBoundingSet=~CAP_WAKE_ALARM                       Service cannot program timers that wake up the system                        
✓ ProtectControlGroups=                                       Service cannot modify the control group file system                          
✓ CapabilityBoundingSet=~CAP_LINUX_IMMUTABLE                  Service cannot mark files immutable                                          
✓ ProtectKernelModules=                                       Service cannot load or read kernel modules                                   
✓ CapabilityBoundingSet=~CAP_SYS_MODULE                       Service cannot load kernel modules                                           
✓ CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG                   Service cannot issue vhangup()                                               
✓ CapabilityBoundingSet=~CAP_SYS_BOOT                         Service cannot issue reboot()                                                
✓ PrivateMounts=                                              Service cannot install system mounts                                         
✓ CapabilityBoundingSet=~CAP_BLOCK_SUSPEND                    Service cannot establish wake locks                                          
✓ MemoryDenyWriteExecute=                                     Service cannot create writable executable memory mappings                    
✓ CapabilityBoundingSet=~CAP_LEASE                            Service cannot create file leases                                            
✓ LockPersonality=                                            Service cannot change ABI personality                                        
✓ ProtectKernelTunables=                                      Service cannot alter kernel tunables (/proc/sys, …)                          
✓ RestrictSUIDSGID=                                           SUID/SGID file creation by service is restricted                             
✗ UMask=                                                      Files created by service are world-readable by default                       0.1

→ Overall exposure level for sshd.service: 7.4 MEDIUM

Well 7.4 isn't the greatest (there is a lot more we could do).
But the point is.. you can make things more secure if you want to.

This works for almost any systemd service file.

Code: 
systemd-analyze security sshd
systemd-analyze security NetworkManager
systemd-analyze security your-custom-service  # if you have any

You can run it against pretty much anything, docker, podman, cron, nginx, anything that has a systemd service file.
 
Last edited:


Another similar module, much like the security module, is "verify", you use it the same way.

Code: 
systemd-analyze verify sshd.service

If you're lucky, you won't see anything, no output ,means, no errors.
But if you created a custom systemd service file, this will show you any typos or errors you might have made.
 
Notice I have two systemd service files for sshd now, How do I know which parameter came from which file?
Well, if I know which directory it's and the name of the file, I could just "cat" it. But here is a much easier way.

Code: 
systemd-analyze cat-config systemd/system/sshd.service

This will output something like this.

Code: 
# /usr/lib/systemd/system/sshd.service
[Unit]
Description=OpenSSH server daemon
Documentation=man:sshd(8) man:sshd_config(5)
After=network.target sshd-keygen.target
Wants=sshd-keygen.target
# Migration for Fedora 38 change to remove group ownership for standard host keys
# See https://fedoraproject.org/wiki/Changes/SSHKeySignSuidBit
Wants=ssh-host-keys-migration.service

[Service]
Type=notify
# Set option as empty variable to suppress warnings upon expanding the command line
# when the config file under /etc does not exist or is empty.
Environment=OPTIONS=
EnvironmentFile=-/etc/sysconfig/sshd
ExecStart=/usr/sbin/sshd -D $OPTIONS
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartSec=42s

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/sshd.service.d/hardening.conf
[Service]
# Kernel protections (sshd doesn't need any of these)
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectKernelTunables=yes
ProtectClock=yes
ProtectControlGroups=yes

# Process protections
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
LockPersonality=yes
RestrictSUIDSGID=yes

# Namespace restrictions
PrivateMounts=yes
PrivateTmp=yes

# Filesystem
ProtectProc=invisible
ProcSubset=pid

# Capability restrictions (safe ones)
CapabilityBoundingSet=~CAP_SYS_MODULE
CapabilityBoundingSet=~CAP_SYS_BOOT
CapabilityBoundingSet=~CAP_SYS_TIME
CapabilityBoundingSet=~CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND
CapabilityBoundingSet=~CAP_LEASE
CapabilityBoundingSet=~CAP_LINUX_IMMUTABLE
CapabilityBoundingSet=~CAP_BPF
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG

Notice it breaks the output into two sections, so I can see which file is doing what.


Now at first glance, I could put this under the security section, but I have other examples, that have
very little to do with security.
 
But before I forget, what are some other things we could do to harden sshd even more than we already did?

Code: 
sudo vi /etc/systemd/system/sshd.service.d/hardening.conf

Code: 
# System call filtering (blocks entire categories of syscalls)
SystemCallFilter=~@clock
SystemCallFilter=~@cpu-emulation
SystemCallFilter=~@debug
SystemCallFilter=~@module
SystemCallFilter=~@mount
SystemCallFilter=~@obsolete
SystemCallFilter=~@raw-io
SystemCallFilter=~@reboot
SystemCallFilter=~@swap

# More capabilities to drop
CapabilityBoundingSet=~CAP_SYS_RAWIO
CapabilityBoundingSet=~CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL
CapabilityBoundingSet=~CAP_AUDIT_READ
CapabilityBoundingSet=~CAP_MAC_ADMIN
CapabilityBoundingSet=~CAP_MAC_OVERRIDE

# Restrict all namespaces
RestrictNamespaces=yes

I should probably mention, dont test these on a production system, and preferably on a system
you have local console access to, in case you break something.

Then go ahead and do a daemon-reload and restart sshd, what is your score now?
 
dos2unix said:
Then go ahead and do a daemon-reload and restart sshd, what is your score now?
Click to expand...

Might just be worth mentioning

Code: 
sudo systemctl daemon-reload

or equivalent, although those using these procedures may be aware of the syntax.

Cheers

Wiz
 
wizardfromoz said:
or equivalent, although those using these procedures may be aware of the syntax.
Click to expand...

To reload

Code: 
systemctl reload sshd

The advantage to using "reload" this way over...

Code: 
systemctl daemon-reload

and then
Code: 
systemctl restart sshd

The first command only affects sshd, the second command affects all systemd-service files system wide.
(sometimes you want this).

But the first command, doesn't restart sshd, it only re-reads the config files.
So I prefer the first command over the second two when possible.

Less disruption, only affects the service you specifically specify, and it's only one command to type in, not two.
 
I was surprised to learn that a few of my friends didn't know this trick.

Code: 
systemctl cat nginx

All this does is list out your nginx service file.

Code: 
# /usr/lib/systemd/system/nginx.service
[Unit]
Description=The nginx HTTP and reverse proxy server
After=network-online.target remote-fs.target nss-lookup.target
Wants=network-online.target

[Service]
Type=forking
PIDFile=/run/nginx.pid
# Nginx will fail to start if /run/nginx.pid already exists but has the wrong
# SELinux context. This might happen when running `nginx -t` from the cmdline.
# https://bugzilla.redhat.com/show_bug.cgi?id=1268621
ExecStartPre=/usr/bin/rm -f /run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t
ExecStart=/usr/sbin/nginx
ExecReload=/usr/sbin/nginx -s reload
KillSignal=SIGQUIT
TimeoutStopSec=5
KillMode=mixed
PrivateTmp=true

[Install]
WantedBy=multi-user.target

# /usr/lib/systemd/system/service.d/10-timeout-abort.conf
# This file is part of the systemd package.
# See https://fedoraproject.org/wiki/Changes/Shorter_Shutdown_Timer.
#
# To facilitate debugging when a service fails to stop cleanly,
# TimeoutStopFailureMode=abort is set to "crash" services that fail to stop in
# the time allotted. This will cause the service to be terminated with SIGABRT
# and a coredump to be generated.
#
# To undo this configuration change, create a mask file:
#   sudo mkdir -p /etc/systemd/system/service.d
#   sudo ln -sv /dev/null /etc/systemd/system/service.d/10-timeout-abort.conf

[Service]
TimeoutStopFailureMode=abort

# /etc/systemd/system/nginx.service.d/php-fpm.conf
[Unit]
Wants=php-fpm.service

Yes, you could do the same thing using
Code: 
cat /usr/lib/systemd/system/nginx.service

But that's a lot more typing, and sometimes (depending on your distro), the service files aren't always were you expect them to be.
 
You must log in or register to reply here.

Similar threads

dos2unix
Blame, we got to blame somebody
Replies
3
Views
804
KGIII
KGIII
CaffeineAddict
Tutorial busctl command, become a D-Bus guru
Replies
0
Views
369
CaffeineAddict
CaffeineAddict
dos2unix
journalctl
Replies
3
Views
2K
wizardfromoz
wizardfromoz
wizardfromoz
Your Browser On Demand - A Couple Of Options - Wizards Corner
Replies
10
Views
3K
wizardfromoz
wizardfromoz
CaffeineAddict
Restoring ALSA state upon reboot
Replies
3
Views
3K
CaffeineAddict
CaffeineAddict


Follow Linux.org

Members online

Total: 4,402 (members: 5, guests: 4,397)

Latest posts

Top