System Security

Take away tools that hosting accounts don't need but attackers love. Per-account process limits (fork-bomb protection) are in Resource Limits.

Compiler Access - restrict to rootA hacked website often downloads and compiles exploit code or bots. Restricting gcc, g++, cc, as and friends stops that. Root, and the accounts you trust below, can still compile. Re-applied automatically after package updates.

Accounts that may still compile (e.g. for Node/Python modules):

demo

7 files affected

/usr/bin/x86_64-linux-gnu-as
/usr/bin/x86_64-linux-gnu-cpp-11
/usr/bin/x86_64-linux-gnu-g++-11
/usr/bin/x86_64-linux-gnu-gcc-11
/usr/bin/x86_64-linux-gnu-gcc-ar-11
/usr/bin/x86_64-linux-gnu-gcc-nm-11
/usr/bin/x86_64-linux-gnu-gcc-ranlib-11

Traceroute - root onlyStops accounts from mapping your network (traceroute, tracepath, mtr).

3 files affected

/usr/bin/mtr
/usr/bin/mtr-packet
/usr/bin/tracepath