Lesson 4.50: Per-service network policy with systemd
A host firewall decides what the whole machine may reach. systemd can go finer: IPAddressAllow= and IPAddressDeny= attach a filter to one service's cgroup, so a report generator may talk to its database and nothing else, whatever its plugins try. In the lab Northwind's reporting worker gained a vendor plugin update yesterday, and the update calls home to an unknown address every night. You trace both programs' connections, test an allow-list with systemd-run, confirm the real work still succeeds, make the policy permanent and write it up.
18 min
You will learn to
- Explain IPAddressAllow/IPAddressDeny and how they differ from a host firewall
- Find a service's outbound connections with strace
- Test an allow-list with systemd-run
- Restrict socket families with RestrictAddressFamilies
- Make network policy part of the unit
Key terms
- IPAddressDeny= / IPAddressAllow=
- systemd settings that attach an address filter to a unit's cgroup; allow wins over deny.
- RestrictAddressFamilies=
- Which socket families a service may create.
- Beaconing
- Regular call-home traffic to a remote server.
- Supply-chain change
- Code arriving through a trusted vendor's update rather than an attacker's login.
- Egress control
- Limiting where systems may connect out to.
← sudo session recording and safe sudo rules · All lessons · User-namespace remapping for Docker →