System hardening
Restrict files and processes
Use dedicated service users, narrow filesystem permissions, controlled working directories, and systemd sandboxing where the application supports it.
8 minute lesson
A web application rarely needs access to the whole server. Give its process a small part of the filesystem and no interactive login.
Run each service as a dedicated unprivileged user. Make code read-only to the process and grant writes only to explicit data directories. Add systemd protections gradually, test them, and avoid giving application users sudo access.
A compromised web process that can write its own executable can make persistence easy. Read-only code and one writable upload directory reduce damage, but overly strict rules can break legitimate updates.
Apply sandboxing one capability at a time and watch service logs. The goal is verified confinement, not a long directive list that operators disable after an unexplained outage.
Record the service user and every required read or write path. Attempt writes to code, configuration, and the approved data directory, then prove only the intended data write succeeds.
Lesson completed