Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
shh — Systemd Hardening Helper - Mirror of https://github.com/desbma/shh | Kitploit
Tools/GitHubGitHub/synacktiv/shh
Cloud Infrastructure SecurityDefensive ToolsConfiguration AuditingDevSecOpsUtilities & FrameworksMisconfiguration
GitHubsynacktiv/shh

shh

Systemd Hardening Helper - Mirror of https://github.com/desbma/shh

View Repository
1763153 months agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

SHH (Systemd Hardening Helper)

CI status crates.io version AUR version nixpkgs unstable version License

Automatic systemd service hardening guided by strace profiling.

SHH can generate an optimal set of hardening options for each of your services, so you can raise the security level of your system without sweating about random errors in production caused by too restrictive sandboxing.

Official repository - Mirror repository

Documentation

  • High level introduction: Systemd hardening made easy with SHH
Download Tool
  • FAQ
  • Changelog
  • Currently supported systemd options

    • Installation

    Dependencies

    Strace needs to be installed and its executable reachable in PATH. Strace version >= 6.6 is currently required.

    From source

    You need a Rust build environment for example from rustup.

    Run in the current repository:

    root@kitploit:~
    cargo build --release
install -Dm 755 -t /usr/local/bin target/release/shh

    From crates.io

    root@kitploit:~
    sudo cargo install --root /usr/local systemd-hardening-helper

    Debian (or Debian based distribution)

    See GitHub releases for Debian packages built for each tagged version.

    Arch Linux

    Arch Linux users can install the shh AUR package.

    Nixpkgs

    Nixos/Nix users can install the latest package from the unstable branch.

    Usage

    Hardening a service

    To harden a system unit named SERVICE.service:

    1. Start service profiling: shh service start-profile SERVICE. The service will be restarted with strace profiling.
    2. Use the service normally for a while, trying to cover as much features and use cases as possible.
    3. Run shh service finish-profile SERVICE -a. The service will be restarted with a hardened configuration built from previous runtime profiling, to allow it to run safely as was observed during the profiling period, and to deny other dangerous system actions.

    Run shh -h for full command line reference, or append -h to a subcommand to get help.

    [!WARNING] The hardening options generated by shh are by construction not portable across different systems. They depend on many factors, and may break the service if any of those change:

    • the code path covered during profiling
    • the Linux kernel version
    • the libc used
    • the systemd version

    Reusing options generated by shh on a system with a different environment (ie. different Linux distribution) is very likely to break the service.

    Testing locally

    If you want to run a quick test to see what options would be generated, you can use shh run -- COMMAND.

    Current directory and PATH environment variable both influence the program execution, reset those first:

    root@kitploit:~
    $ cd /
export PATH=/usr/local/bin:/usr/bin:/bin

    Then to see what options would be generated for a curl https://www.example.com invocation:

    root@kitploit:~
    $ shh run -- curl https://www.example.com
...
-------- Start of suggested service options --------
ProtectSystem=strict
ProtectHome=true
PrivateTmp=disconnected
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectProc=ptraceable
LockPersonality=true
RestrictRealtime=true
ProtectClock=true
MemoryDenyWriteExecute=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
SocketBindDeny=ipv4:tcp
SocketBindDeny=ipv4:udp
SocketBindDeny=ipv6:tcp
SocketBindDeny=ipv6:udp
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYSLOG CAP_WAKE_ALARM
SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @swap:EPERM @sync:EPERM @timer:EPERM
-------- End of suggested service options --------

    Or to sandbox as much as possible:

    root@kitploit:~
    $ shh run --mode aggressive --filesystem-whitelisting --network-firewalling -- curl https://www.example.com -o /dev/null
...
-------- Start of suggested service options --------
ProtectSystem=strict
ProtectHome=true
PrivateTmp=disconnected
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectProc=ptraceable
LockPersonality=true
RestrictRealtime=true
ProtectClock=true
MemoryDenyWriteExecute=true
SystemCallArchitectures=native
ReadOnlyPaths=-/
ReadWritePaths=-/dev
InaccessiblePaths=-/boot -/home -/lost+found -/media -/mnt -/opt -/root -/srv -/sys -/tmp -/var
TemporaryFileSystem=/usr:ro
BindReadOnlyPaths=-/usr/bin -/usr/lib -/usr/lib64 -/usr/local -/usr/share
NoExecPaths=-/
ExecPaths=-/usr/bin/curl -/usr/lib/x86_64-linux-gnu
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
SocketBindDeny=ipv4:tcp
SocketBindDeny=ipv4:udp
SocketBindDeny=ipv6:tcp
SocketBindDeny=ipv6:udp
IPAddressDeny=any
IPAddressAllow=[redacted]
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYSLOG CAP_WAKE_ALARM
SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @swap:EPERM @sync:EPERM @timer:EPERM
-------- End of suggested service options --------

    License

    GPLv3