30 lines
855 B
Desktop File
30 lines
855 B
Desktop File
[Unit]
|
|
Description=Dedicated Custodian Codex SSH transport (not assignment admission)
|
|
Requires=cust73-network.service
|
|
After=network.target cust73-network.service
|
|
ConditionPathExists=/etc/cust73/authorized_keys
|
|
ConditionPathExists=/etc/cust73/launch-approved
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStartPre=/usr/local/lib/cust73/verify-guest.py
|
|
ExecStartPre=/usr/sbin/sshd -t -f /etc/cust73/sshd_config
|
|
ExecStart=/usr/sbin/sshd -D -e -f /etc/cust73/sshd_config
|
|
Restart=no
|
|
UMask=0077
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
PrivateMounts=yes
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/home/custodian-codex /run
|
|
ProtectHome=read-only
|
|
InaccessiblePaths=/root /mnt /media -/run/WSL -/run/docker.sock -/run/podman -/run/user/1000
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
MemoryMax=2G
|
|
TasksMax=256
|
|
CPUQuota=100%
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|