What is systemd service hardening?

systemd hardening leverages Linux kernel namespaces and cgroups (such as ProtectSystem=strict, PrivateTmp=true, and NoNewPrivileges=true) to isolate daemons and restrict unauthorized access to /etc, /root, and devices.

Does this tool execute systemd commands on a remote server?

No. The analyzer inspects unit file directives purely client-side using JavaScript parsing rules, keeping your internal service names, user accounts, and executable paths private.

systemd Unit Analyzer & Security Hardening Auditor

Audit systemd .service and .timer unit files. Measure sandboxing exposure levels (equivalent to systemd-analyze security), identify privilege escalation risks, and apply Linux kernel isolation directives.

SYSTEMD UNIT FILE INPUT 0 lines

SECURITY HARDENING CHECKLIST 0 checks evaluated

Click "Analyze Unit" to inspect systemd directives.

Frequently Asked Questions

How is the systemd security exposure score calculated?

Similar to systemd-analyze security, lower scores indicate a more secure, isolated service (0.0 to 3.0 is Hardened/Protected, 3.1 to 6.0 is Moderate, and 6.1 to 10.0 is Dangerous/Exposed). Each missing kernel sandbox flag adds exposure risk.

What is NoNewPrivileges=true?

This directive guarantees that neither the process nor any of its child processes can ever gain new privileges through setuid or setgid binaries (like sudo or suid exploits).