Re: FYI: System hardening on Debian and Ubuntu and Monit

Can confirm this change (as in the linked commit on the FAQ page) is
live on fresh installs of Ubuntu 24.04. On those installs, the
service-file can be found in /usr/lib/systemd/system/monit.service
(not /lib/...). I just tested it with a freshly created Ubuntu 24.04
Cloud-Host on Hetzner's cloud.

Current fresh Debian 12 installs still use the sysv init script with a
systemd wrapper and therefore don't show that "problem".

Yours Henning

Am Mo., 10. Juni 2024 um 13:09 Uhr schrieb Jan-Henrik Haukeland
<[email protected]>:
>
> FYI: The Debian maintainer has set up system hardening for Monit [1] which I believe is also carried over to Ubuntu 24. It is worth considering that system hardening could potentially influence the execution of the monit binary. System hardening measures include settings that restrict the execution environment of binaries, such as:
>
>    • Restricting Execution Permissions: Ensuring that only certain binaries or scripts can be executed.
>    • Changing Execution Contexts: Applying sandboxing techniques or limiting the capabilities of the binary.
>
> To determine if system hardening is affecting the monit binary, you can check the Monit service file at /lib/systemd/system/monit.service for any hardening options enabled. These might include directives like NoNewPrivileges, ProtectSystem, ProtectHome, CapabilityBoundingSet, etc.
>
> See also https://mmonit.com/wiki/Monit/FAQ#hardening
>
>