Linux - Tag - arleo.euhttps://www.arleo.eu/en/tags/linux/Linux - Tag - arleo.euHugo -- gohugo.ioenSat, 09 May 2026 13:02:29 +0200systemd hardening: taking a Python service from 9.6 to 1.7https://www.arleo.eu/en/posts/hardening-systemd-mcp/Sat, 09 May 2026 13:02:29 +0200Jmrhttps://www.arleo.eu/en/posts/hardening-systemd-mcp/

TL;DR

systemd-analyze security is an underused tool. It scans your unit files and computes an exposure score from 0.0 (UNSAFE) to 10.0 (PERFECT). Custom Python services often score around 9.6 by default — that’s bad.

I took my hugo-mcp service (FastAPI exposing 7 MCP tools) from 9.6 → 1.7 without breaking a single feature. Here are the directives that actually matter, and the ones that are traps.

Initial score

]]>