···

       
85
       
85
       
 
       
        AmbientCapabilities = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];

     

       
86
       
86
       
 
       
        CapabilityBoundingSet = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];

     

       
87
       
87
       
 
       
        PrivateUsers = cfg.port >= 1024;

     

       
88
       
88
       
+
       
        DynamicUser = true;

     

       
88
       
89
       
 
       
        LockPersonality = true;

     

       
89
       
90
       
 
       
        MemoryDenyWriteExecute = true;

     

       
90
       
91
       
 
       
        PrivateDevices = true;

     
···

       
95
       
96
       
 
       
        ProtectKernelLogs = true;

     

       
96
       
97
       
 
       
        ProtectKernelModules = true;

     

       
97
       
98
       
 
       
        ProtectKernelTunables = true;

     

       
98
       
98
       
-
       
        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];

     

       
99
       
99
       
+
       
        ProtectProc = "invisible";

     

       
100
       
100
       
+
       
        # AF_UNIX is for ssh-keygen, which relies on nscd to resolve the uid to a user

     

       
101
       
101
       
+
       
        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];

     

       
99
       
102
       
 
       
        RestrictNamespaces = true;

     

       
100
       
103
       
 
       
        RestrictRealtime = true;

     

       
101
       
104
       
 
       
        SystemCallArchitectures = "native";

     

···

       
30
       
30
       
 
       
    server.wait_for_unit("uptermd.service")

     

       
31
       
31
       
 
       
    server.wait_for_unit("network-online.target")

     

       
32
       
32
       
 
       


     

       
33
       
33
       
+
       
    # wait for upterm port to be reachable

     

       
34
       
34
       
+
       
    client1.wait_until_succeeds("nc -z -v server 1337")

     

       
35
       
35
       
+
       


     

       
33
       
36
       
 
       
    # Add SSH hostkeys from the server to both clients

     

       
34
       
37
       
 
       
    # uptermd needs an '@cert-authority entry so we need to modify the known_hosts file

     

       
35
       
35
       
-
       
    client1.execute("sleep 3; mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")

     

       
38
       
38
       
+
       
    client1.execute("mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")

     

       
36
       
39
       
 
       
    client1.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts")

     

       
37
       
37
       
-
       
    client2.execute("sleep 3; mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")

     

       
40
       
40
       
+
       
    client2.execute("mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")

     

       
38
       
41
       
 
       
    client2.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts")

     

       
39
       
42
       
 
       


     

       
40
       
43
       
 
       
    client1.wait_for_unit("multi-user.target")