harden_sshguard.service.patch

Index: sshguard-2.4.3/examples/sshguard.service
===================================================================
--- sshguard-2.4.3.orig/examples/sshguard.service
+++ sshguard-2.4.3/examples/sshguard.service
@@ -9,6 +9,19 @@ After=libvirtd.service
 After=firewalld.service
 
 [Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions 
 ExecStartPre=-/usr/sbin/iptables -N sshguard
 ExecStart=/usr/local/sbin/sshguard
 Restart=always
Accepting request 1114698 from home:amanzini:branches:security - update to version 2.4.3: * Add signature for BIND * Add signature for Gitea * Add signature for Microsoft SQL Server for Linux * Add signature for OpenVPN Portshare * Add signature for user-defined HTTP attacks * Update signatures for Dovecot * Update signatures for Postfix * Fixed Fix memset off-by-one * Fixed Resolve DNS names in capability mode using casper - removed patch sshguard-overflow.patch as fixed in upstream - clean up .spec file OBS-URL: https://build.opensuse.org/request/show/1114698 OBS-URL: https://build.opensuse.org/package/show/security/sshguard?expand=0&rev=51 2023-11-07 13:09:59 +00:00			`Index: sshguard-2.4.3/examples/sshguard.service`
Accepting request 933482 from home:jsegitz:branches:systemdhardening:security Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort OBS-URL: https://build.opensuse.org/request/show/933482 OBS-URL: https://build.opensuse.org/package/show/security/sshguard?expand=0&rev=46 2021-12-28 13:39:05 +00:00			`===================================================================`
Accepting request 1114698 from home:amanzini:branches:security - update to version 2.4.3: * Add signature for BIND * Add signature for Gitea * Add signature for Microsoft SQL Server for Linux * Add signature for OpenVPN Portshare * Add signature for user-defined HTTP attacks * Update signatures for Dovecot * Update signatures for Postfix * Fixed Fix memset off-by-one * Fixed Resolve DNS names in capability mode using casper - removed patch sshguard-overflow.patch as fixed in upstream - clean up .spec file OBS-URL: https://build.opensuse.org/request/show/1114698 OBS-URL: https://build.opensuse.org/package/show/security/sshguard?expand=0&rev=51 2023-11-07 13:09:59 +00:00			`--- sshguard-2.4.3.orig/examples/sshguard.service`
			`+++ sshguard-2.4.3/examples/sshguard.service`
Accepting request 933482 from home:jsegitz:branches:systemdhardening:security Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort OBS-URL: https://build.opensuse.org/request/show/933482 OBS-URL: https://build.opensuse.org/package/show/security/sshguard?expand=0&rev=46 2021-12-28 13:39:05 +00:00			`@@ -9,6 +9,19 @@ After=libvirtd.service`
			`After=firewalld.service`

			`[Service]`
			`+# added automatically, for details please see`
			`+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort`
			`+ProtectSystem=full`
			`+ProtectHome=true`
			`+PrivateDevices=true`
			`+ProtectHostname=true`
			`+ProtectClock=true`
			`+ProtectKernelTunables=true`
			`+ProtectKernelModules=true`
			`+ProtectKernelLogs=true`
			`+ProtectControlGroups=true`
			`+RestrictRealtime=true`
			`+# end of automatic additions`
			`ExecStartPre=-/usr/sbin/iptables -N sshguard`
			`ExecStart=/usr/local/sbin/sshguard`
			`Restart=always`