systemd - Stephan Herbers

DIY Linux Router Part 6: WireGuard VPN

The following is the sixth part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. Part 1: HardwarePart 2: Interfaces, DHCP and VLANPart 3: PPPOE and RoutingPart 4: Firewall and Port ForwardsPart 5: DNS with UnboundI don't have

linux

DIY Linux Router Part 2: Interfaces, DHCP and VLAN

The following is the second part of a multipart series describing how I build (software not hardware) my own Linux router from scratch, based on Debian 11. Part 1: HardwarePart 3: PPPOE and RoutingPart 4: Firewall and Port ForwardsPart 5: DNS with UnboundPart 6: WireGuard VPNThe base system for my

systemd

Borg Backup without root

I use Borg Backup as my current backup software. I'm not going into details about using borg here, I will show you how you can write a systemd service that can backup all files on your system without running as root. This also applies to other backup software not just

systemd

Use TemporaryFileSystem to hide files or directories from systemd services

For decades people used chroot to restrict the access a service has to the filesystem tree. This was never meant to be a security boundary and there are many ways to break out of it. Implementations got better over time, but where never good enough to be called a security

systemd

Continuously import Logfiles into journald

I use Journalbeat to forward my systemd-journal to Logstash/Elasticsearch. When possible, I configure every software on my servers to log to syslog which on moderns systems means logging to systemd-journald. If they don't support syslog I can also log to stdout which systemd writes to the syslog by default

nginx

Running NGINX without root

Update 08.01.2021: Use LogsDirectory and CacheDirectory instead of ReadWritePaths. I like creating my own systemd services for software that hasn't one or only a very basic one with little to no sandboxing. See my goals when creating my own services and explanations for all the sandboxing features here: