Lab: Create and manage a systemd service

What you will learn in this TP

• Manage packages and services
• Write a hardened systemd unit
• Schedule with a timer

Introduction #

What you will learn in this section

• Manage packages and services
• Write a hardened systemd unit
• Schedule with a timer

Context. A small internal application is started by hand in a terminal and stops at every logout. You turn it into a proper, supervised and hardened service.

Prerequisites: a disposable Ubuntu 24.04 virtual machine (Multipass, Vagrant or cloud) with a sudo account  ·  Estimated time: 45 min

A service that starts at boot, restarts on its own and is checked every minute.

Hands-on #

Guided steps, with their solution.

1. 1. Install and manage nginx

   Why? A distribution package already ships its systemd unit: learn the commands on a simple case.

   Update the index, install nginx, check it is active and enabled at boot, and test it with curl.

2. 2. Prepare the application

   Why? The application runs under a dedicated service account, never root.

   Create the app account (if missing) and a static site in /srv/app/www served by python3 -m http.server on port 8080.

3. 3. Write the unit

   Why? systemd starts the service at boot, restarts it on crash and isolates it from the rest of the system.

   Create /etc/systemd/system/app.service with Restart=on-failure and hardening options, reload systemd, enable and start the service.

4. 4. Test automatic restart

   Why? Verify crash behaviour instead of assuming it.

   Kill the main process with SIGKILL, see a new PID appear, then find the event in the journal.

5. 5. Override the unit

   Why? A drop-in override changes a service without editing its file, and survives updates.

   Limit the service memory to 200 MB and CPU to 50% with an override, then check the applied values and the security score.

6. 6. Schedule a check with a timer

   Why? A systemd timer logs every run and catches up missed ones, unlike cron.

   Create a healthcheck service querying /health and a timer running it every minute. Stop the application and watch the failure in the journal.

Difficulty level : ●●○○○ (2/5)