I am hardening various systemd settings for Ubuntu Server 20.04.
However, there are a lot of potential systemd attributes that can interfere with legitimate processes.
Therefore, I would like to set-up bash scripts to quickly activate / deactivate my -all- of my custom systemd service settings,simultaneously, for times when I need to troubleshoot a non-functioning service.
Parameters:
For every service that I customize, I create <name>.service.d/ directory
For every service that I customize, I save the new settings in a file named <name>.service-custom.conf
This way I never worry about updates overwriting my custom settings.
For Example
Currently, I can manually execute:
#mv /etc/systemd/system/php7.3-fpm.service.d/php7.3-fpm.service-custom.conf /etc/systemd/system/php7.3-fpm.service.d/php7.3-fpm.service-custom.conf.bak && systemctl daemon-reload && systemctl restart php7.3-fpm.service
And the above will move my custom settings to a .bak file restart the daemon and return the php7.3-fpm service to its default state, turning my custom settings "off".
(i.e. /usr/bin/systemd-analyze security will show the default status of the service php7.3-fpm.service 9.6 UNSAFE )
Conversely, I can manually execute:
#mv /etc/systemd/system/php7.3-fpm.service.d/php7.3-fpm.service-custom.conf.bak /etc/systemd/system/php7.3-fpm.service.d/php7.3-fpm.service-custom.conf && systemctl daemon-reload && systemctl restart php7.3-fpm.service
And the above will re-apply my custom systemd settings. Turning my custom settings "On"
(i.e./usr/bin/systemd-analyze security will reflect my service hardening progress php7.3-fpm.service 6.1 MEDIUM
Question:
What path & filename variables can I use to apply the above manual commands to ALL services that match the directory and file name structure that I used above, at the same time?
Thereby, effectively creating a light-switch "on/off" function for all of my systemd service customization.
"Off"
mv /etc/systemd/system/<name>service.d/<name>-custom.conf /etc/systemd/system/<name>.service.d/<name>-custom.conf.bak && systemctl daemon-reload && systemctl restart <name>.service
And
"On"
mv /etc/systemd/system/<name>service.d/<name>-custom.conf.bak /etc/systemd/system/<name>service.d/<name>-custom.conf && systemctl daemon-reload && systemctl restart <name>.service
