Linux – What’s the systemctl equivalent for a command like ‘chkconfig –level 5 iptables on’

chkconfiglinuxsystemd

I know systemctl enable iptables is similar to the command chkconfig --level 5 iptables on, but both are not exactly same.

Using systemctl, how do we restrict a service to be started only on a given target like graphical.target.

Best Answer

That's what the WantedBy= and RequiredBy= directives in systemd unit files are for:

From man systemd.unit:

WantedBy=, RequiredBy=

This option may be used more than once, or a space-separated list of unit names may be given. A symbolic link is created in the .wants/ or .requires/ directory of each of the listed units when this unit is installed by systemctl enable. This has the effect that a dependency of type Wants= or Requires= is added from the listed unit to the current unit. The primary result is that the current unit will be started when the listed unit is started. See the description of Wants= and Requires= in the [Unit] section for details.

So the symbolic link created is what causes systemd to start the given unit when the target/unit is started.

So for example:

[Install]
WantedBy=graphical.target

Would cause the unit to only be started when graphical.target is run (if the unit is enabled).

Another example:

[Install]
WantedBy=my-custom-target.target graphical.target

Would cause the unit to be started when my-custom-target.target or graphical.target is run (if the unit is enabled).

One final thing to keep in mind, it can be difficult to restrict things to a single target because some targets depend on others. For example, graphical.target Requires=multi-user.target, so when graphical.target is started all units from multi-user.target are also started. Just keep in mind that some targets are built up on top of others, and that the ones built on top will get everything from the targets they depend on.

Related Solutions

Linux – How to Restrict Internet Access for a Particular User Using Iptables

I assume that users A and B are using the same Linux machine(s) where you are the administrator. (It's not completely clear from your question. If A and B are have their own computers which they are administrators on, it's a completely different problem.)

The following command will prevent the user with uid 1234 from sending packets on the interface eth0:

iptables -t mangle -A OUTPUT -o eth0 -m owner --uid-owner 1234 -j DROP
ip6tables -t mangle -A OUTPUT -o eth0 -m owner --uid-owner 1234 -j DROP

I recommend reading the Ubuntu iptables guide to get basic familiarity with the tool (and refer to the man page for advanced things like the mangle table).

The user will still be able to run ping (because it's setuid root), but not anything else. The user will still be able to connect to a local proxy if that proxy was started by another user.

To remove this rule, add -D to the command above.

To make the rule permanent, add it to /etc/network/if-up.d/my-user-restrictions (make that an executable script beginning with #!/bin/sh). Or use iptables-save (see the Ubuntu iptables guide for more information).

How do systemd and chkconfig interact with respect to services and runlevels

From the fedora wiki page about systemd:

Does chkconfig command work with systemd?

Yes, for turning on/off services, compatibility has been provided both ways. chkconfig has been modified to call systemctl when dealing with systemd service files. Also systemctl automatically calls chkconfig when dealing with a traditional sysv init file.

This means you should be able to use either one of the tools for managing your services.

The concept of runlevels still exists, e.g (this is a Debian system):

ls -l runlevel*.target
lrwxrwxrwx 1 root root 15 Jun  5 22:57 runlevel0.target -> poweroff.target
lrwxrwxrwx 1 root root 13 Jun  5 22:57 runlevel1.target -> rescue.target
lrwxrwxrwx 1 root root 17 Jun  5 22:57 runlevel2.target -> multi-user.target
lrwxrwxrwx 1 root root 17 Jun  5 22:57 runlevel3.target -> multi-user.target
lrwxrwxrwx 1 root root 17 Jun  5 22:57 runlevel4.target -> multi-user.target
lrwxrwxrwx 1 root root 17 Jun  5 22:57 runlevel5.target -> multi-user.target
lrwxrwxrwx 1 root root 13 Jun  5 22:57 runlevel6.target -> reboot.target

Best Answer

Related Solutions

Linux – How to Restrict Internet Access for a Particular User Using Iptables

How do systemd and chkconfig interact with respect to services and runlevels

Related Question