Give each service its own dedicated account

Description

Each service runs under its own system account, used by nothing else: not shared with another service, not a person's account, and not root unless the service truly needs it.

Rationale

Unix permissions separate users, not programs. Services sharing an account can read and modify each other's files, keys and memory, so the weakest one exposes all of them.

Impact

Separating services that shared an account means new accounts, new file ownership and sometimes new group memberships.

Audit

1. List running services and their users: ps -eo user,comm --sort=user and systemctl show -p User --value <unit> for each service unit.
2. Check that no account runs two unrelated services, that no service runs as a person's account, and that services running as root need it.

Remediation

Create a system account per service (adduser --system --group <name>), give it ownership of its files only, and set User= and Group= in the service unit (or use DynamicUser=yes).

References

• systemd.exec(5), Debian manual pages (User=, DynamicUser=) Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R35) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle