50 lines
1.7 KiB
Desktop File
50 lines
1.7 KiB
Desktop File
# The line-speed test server on ep0 (R-1247; operator ruling 2026-10-24 07:26). A box's agent runs a 10-second
|
|
# upload test against it once a week, inside the WireGuard tunnel. Installed by hand on ep0 as
|
|
# /etc/systemd/system/felhom-iperf3.service; the firewall line that opens it is in README.md beside this file.
|
|
#
|
|
# Bound to the tunnel address only, TCP only (the nftables line admits TCP from wg0 10.77.0.0/24). Debian's own
|
|
# iperf3.service stays disabled. The caps bound the two open no-DSA server issues of iperf3 3.18 (CVE-2026-71217:
|
|
# oversized parameters exhaust memory and threads; CVE-2026-102253: a UDP worker spins — UDP never reaches it):
|
|
# MemoryMax/TasksMax/CPUQuota keep PBS safe, RuntimeMaxSec restarts a stuck server once a day.
|
|
[Unit]
|
|
Description=Felhom: iperf3 line-speed test server, tunnel only (R-1247)
|
|
Documentation=https://gitea.dooplex.hu/admin/felhom.eu/src/branch/main/scripts/ep0-iperf3/README.md
|
|
After=wg-quick@wg0.service
|
|
Wants=wg-quick@wg0.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/bin/iperf3 --server --bind 10.77.0.1 --port 5201 --interval 0 --idle-timeout 120 --rcv-timeout 15000
|
|
SuccessExitStatus=1
|
|
Restart=always
|
|
RestartSec=10
|
|
RuntimeMaxSec=1d
|
|
DynamicUser=yes
|
|
NoNewPrivileges=yes
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
MemoryMax=128M
|
|
TasksMax=16
|
|
CPUQuota=50%
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|