George Y's questions

This is really annoying that systemd only responded that my configuration of a service file is wrong, but does not specify where is wrong exactly:

/lib/systemd/system/auto_pgha.service:

[Unit]
Description=PostgreSQL High Availability
After=network.service
After=firewalld.service


[Service]
Type=simple
WorkingDirectory=/etc/repmgr
ExecStartPre=/bin/bash -c 'echo -e "\n"  `date +"%Y/%m/%d %a, %X"`": STARTING \n"  >> pgha.log'
ExecStart=/bin/bash -c "python3 pg_high_availability.py  &>> pgha.log"
Restart=always
RestartSec=3

[Install]
WantedBy=multi-user.target

Inside directory /etc/repmgr the two commands worked just fine. But the systemd service just responded with an error:

# systemctl start auto_pgha
Failed to start auto_pgha.service: Unit auto_pgha.service has a bad unit file setting.
See system logs and 'systemctl status auto_pgha.service' for details.

# systemctl status -l auto_pgha
○ auto_pgha.service - PostgreSQL High Availability
     Loaded: bad-setting (Reason: Unit auto_pgha.service has a bad unit file setting.)
......
auto_pgha.service: Unit configuration has fatal error, unit will not be be started. 

Dangerous commands like rm , kill and systemctl stop can be hidden outside bash inputs - i.e. - a malicious user can easily hide them inside a python script using os module and just run the python script as a proxy to hide what they really intended to harm, and the bash history or anything like that will only leave the record that they run python3 [the malicious script].py before they delete that script to hide what they really did.

What I want to do is log those critical commands (any commands beyond the 3 is welcomed to point out) each time they got executed, no matter where it came from. And the log must not be disposable by any user except for root.

I recently came across a High Availability scenario that the maintenance program needs to bind a virtual IP to the server it sits and then broadcast it over the network. To do so it runs ip and arp command respectively. However, I noticed that any such maintenance program needs sudoer privilege to run ip or arp. I do not give such root like privilege to it but want it still able to run these two commands. So is there a solution? Thanks in advance.

I set up an python environment in path \pyenv\1st\ by

cd /
mkdir pyenv
python3 -m venv /pyenv/1st

The official method to activate this environment is to type this command manually:

. /pyenv/1st/bin/activate or source /pyenv/1st/bin/activate,

which will result in (1st) in front of prompt and load corresponding python libraries.

I want to save typing and put this command in a file mypy, but sh mypy won't change the current terminal to the 1st python environment as I manually type that command. Add that command to \etc\bashrc won't help either. I heard that the source command will end in the subprocess like sh mypy but won't affect the terminal at all.

Can anyone solve this problem? Either a simple command or automatically load that environment as I open a terminal will help. Thanks in advance.

What I want to achieve is this

[Postgresql Database] -- transparent TCP -- [clients on the cloud]

[Postgresql Database] -- transparent TCP -- [nginx on jump server] --SSL TCP-- [clients outside the cloud]

I would like to add an additional layer of SSL encryption by nginx reverse proxy on stream with SSL parameter.

The added configuration in nginx.conf is this (with SSL certificates and keys already made)

stream{
        upstream pg{
                server [postgresql server ip]:5432;
        }
        server{
                listen  5430;
                #ssl_preread on;
                ssl_protocols       TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
                ssl_ciphers         AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
                ssl_certificate /etc/nginx/cert/server.crt;
                ssl_certificate_key /etc/nginx/cert/server.key;
                ssl_session_timeout 2h;
                ssl_verify_client off;
                proxy_pass pg;
        }
}

I tried to telnet [jump server public ip] 5430 and the connection opened. However as I uses dbeaver client to connect to that gateway, it responded 'SSL is not allowed on the server'. What is wrong? Does postgresql know that this dbeaver client's connection with nginx is SSL encrypted and replied an error message?

I want to install ntpdate as usual on CentOS8. However, it is not available:

# cat /proc/version
Linux version 4.18.0-240.1.1.el8_3.x86_64 ([email protected]) (gcc version 8.3.1 20191121 (Red Hat 8.3.1-5) (GCC)) #1 SMP Thu Nov 19 17:20:08 UTC 2020

# yum install -y ntpdate
Last metadata expiration check: 2:21:14 ago on Mon 11 Apr 2022 07:39:43 PM CST.
Module yaml error: Unexpected key in data: static_context [line 9 col 3]
Module yaml error: Unexpected key in data: static_context [line 9 col 3]
No match for argument: ntpdate
Error: Unable to find a match: ntpdate

Besides, I also find links lynx unavailable. Is there any way to install ntpdate on CenOS 8 ?

I get a project where the outer websocket reverse-proxy is implemented by nginx stream.

However, steam only means "TCP" and it lost http features like writing the IP's alone the route.

Here is the config of the outer layer in encrypted SSL:

stream{ 
        upstream mysvr {
            server 10.3.3.7:1111;
    }
        server {
            listen 3331; 
            ssl_preread on;
            # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass mysvr;
    }
......

the proxy_set_header clause has to be commented out since nginx does not allow it here if not: "proxy_set_header" directive is not allowed here

And here is the configuration of nginx on 10.3.3.7 machine:

http{   
     server {
                listen 1111 ssl;
                server_name localhost;
                ssl_certificate /etc/nginx/cert/server.crt;
                ssl_certificate_key /etc/nginx/cert/server.key;
                ssl_session_timeout 5m;
                ssl_verify_client off;
        location / {
            proxy_pass http://10.3.3.5:8888;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }
......

So I tried to rewrite the first and outer reverse proxy to http 1.1 type, the real websocket proxy instead of the TCP or "stream" connection. I moved everything out of the stream bracket and put it in http bracket and remove the comment before proxy_set_header, finally add in the the three websocket specific clauses at the end of the second and inner reverse proxy:

http {
       upstream mysvr {
            server 10.3.3.7:1111;
    }
       server {
           listen 3331; 
           ssl_preread on;
           proxy_set_header Host $http_host;
           proxy_http_version 1.1;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection "upgrade";
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_pass mysvr;
    }
......

But this time the nginx throw out an error:[emerg] "ssl_preread" directive is not allowed

So the conflict is:

Under steam I cannot use proxy_set_header; while under http 1.1 I cannot use ssl_preread.

But they are both important features in this scenario:

The real backend server need to know the real client's IP thus need to stamp the IP at the outer server into the header; The outer proxy server is prohibited from reading the transparent traffic but allow the inner reverse-proxy to decoded it with SSL. Thus the traffic between the real backend 10.3.3.5 and the inner reverse-proxy 10.3.3.7 is transparent while the traffic from inner reverse-proxy through the outer reverse-proxy to the client is encoded with the same SSL by the nginx on inner reverse-proxy.

Additional feature is that the real backend 10.3.3.5 routes via 10.3.3.7 the inner reverse-proxy , which routes via the outer reverse-proxy. So the proxy vpn and reverse proxy routes are coherent.

Under this setting, is there a way to achieve the 2 features at the same time? Thanks for reading.

First, this issue becomes a problem only on CentOS8, while it works well on CentOS7. This is the version:

# cat /etc/redhat-release
CentOS Linux release 8.3.2011

I tried to make a service to execute bash commands to change route. Here is the executable bash /root/route_degrade.sh:

#!/bin/bash
# ensure router role
echo "1" > /proc/sys/net/ipv4/ip_forward
systemctl start firewalld
firewall-cmd --add-masquerade
#firewall-cmd --add-port=1194/udp
firewall-cmd --add-service=openvpn

# degrade original default router to LAN only router
cloudroute=$(ip route | grep default | cut -d " " -f 3)
if [[ $cloudroute == 10.* ]]; then
  ip route add 10.0.0.0/8 via $cloudroute
  ip route del default
fi
exit 0

This executable is absolutely OK since I did execute it alone in root directory by ./route_degrade.sh.

and here is the autoinit.service in /usr/lib/systemd/system:

[Unit]
Description=Changes Default route to Route within cloud Permanently
After=firewalld.service
#Before=openvpn@Client_d.service


[Service]
Type=notify
ExecStart=/root/route_degrade.sh
PrivateTmp=true

[Install]
WantedBy=multi-user.target

But it keeps on failing, even after I reload the service files by systemctl daemon-reload and restart it, here is the status by systemd:

● autoinit.service - Changes Default route to Route within cloud Permanently
   Loaded: loaded (/usr/lib/systemd/system/autoinit.service; disabled; vendor preset: disabled)
   Active: failed (Result: protocol) since Sat 2022-03-26 17:03:18 CST; 17s ago
  Process: 6924 ExecStart=/root/route_degrade.sh (code=exited, status=0/SUCCESS)
 Main PID: 6924 (code=exited, status=0/SUCCESS)

Mar 26 17:03:17 10-13-107-213 systemd[1]: Starting Changes Default route to Route within cloud Permanently...
Mar 26 17:03:17 10-13-107-213 route_degrade.sh[6924]: Warning: ALREADY_ENABLED: masquerade already enabled in 'public'
Mar 26 17:03:17 10-13-107-213 route_degrade.sh[6924]: success
Mar 26 17:03:18 10-13-107-213 route_degrade.sh[6924]: Warning: ALREADY_ENABLED: 'openvpn' already in 'public'
Mar 26 17:03:18 10-13-107-213 route_degrade.sh[6924]: success
Mar 26 17:03:18 10-13-107-213 systemd[1]: autoinit.service: Failed with result 'protocol'.
Mar 26 17:03:18 10-13-107-213 systemd[1]: Failed to start Changes Default route to Route within cloud Permanently.

I don't know where is wrong, obviously it did execute the bash script and the firewall-cmd commands threw out success and it captures the exit code 0. So what does the Failed with result 'protocol' mean?

It is easy to start a process at background or make it as systemd service.

However, if I want to start a process that monitors activities on the Linux machine, it fells to the target of attacks. If any user want to do something bad it will first kill this process, even if they are only sudoers or wheel users, by simply executing kill or systemctl stop.

Is there a way to enforce a process that only root can kill?

Guys, just to think that even rsyslog service can be killed, you should acknowledge how vulnerable Linux really is. It is like a pilot can turn off black-box. Does any airline allow this to happen? Or does any give the pilot an allow-list to hinder them from doing anything they can to save the plane? Of course the pilot Can crash the plane but black box will Record it.

My proposal on a ban-list is legitimate from security perspective, even though it may freak you out. So don't try to blame the guy who raised the question, all right?

There is a function using TCP pass through like this:

stream {
    upstream web_server {
        # the site to be visited is https://whatismyip.com, below is its real address
        server 104.27.194.88:443;
    }

    server {
        listen 443;
        ssl_preread on;
        proxy_pass web_server;
    }
}

reference

Therefore, if I type the public IP address of that nginx server after "https://" on my browser, given all the firewalls allowed, can I in fact reach the target site?

Actually what I got is whether to allow the ssl certificate from nginx server, then allowed, but got 403 forbidden by cloudflare.

If something went wrong, how to improve? Thanks.

I have a particular application with one type of connection that mostly sends packets to clients while receives nothing but login request. (i.e. video streaming)

Therefore I want to limit the Total Volumn Received from a TCP connection (websocket connection to be specific) within a maximum amount. Anything beyond that would result in connection drop.

At the application level, there is still not a limit on how large the websocket message received can be. So it is prone to sheer volumn attack until a security measure is enforced.

Thanks for any advice. -- Add: CentOS Linux with Nginx or HAproxy as reverse proxy--

I want to monitor the server at a more strict history. Since each user can delete their own history file, it is better to capture each command to a history file in the background, which is unaccessible by them. I have already set up an udp server, and know how to send anything to that port via nc:

echo [command string] | nc -u [port]

Is there a way to capture each command string once it is entered in the prompt?

I have installed Wireguard on Windows 7-32bit And set the config:

[Interface]
PrivateKey = *********
Address = 172.22.2.2/24
DNS = 172.22.2.1

[Peer]
PublicKey = *******
AllowedIPs = 0.0.0.0/0
Endpoint = ******:8755
PersistentKeepalive = 45

Pretty sure that the DNS setting does not matter, since I have '#' it and set it to '8.8.8.8' while everything the same. AllowedIPs neither matters since it was set as '172.22.2.1' & '172.22.2.1/24'

It did connect at first, but quickly fails. The pop-up sugguest everything goes wrong from

Unable to set interface addresses, routes, dns, and/or interface settings

Here is the entire log for a single trial of connection:

2020-10-11 14:00:12.436200: [TUN] [OneVPS] Starting WireGuard/0.1.1 (Windows 6.1.7601; 386)
2020-10-11 14:00:12.437200: [TUN] [OneVPS] Watching network interfaces
2020-10-11 14:00:12.445200: [TUN] [OneVPS] Resolving DNS names
2020-10-11 14:00:12.445200: [TUN] [OneVPS] Creating Wintun interface
2020-10-11 14:00:13.938200: [TUN] [OneVPS] Warning: unable to determine Wintun version: The system cannot find the file specified.
2020-10-11 14:00:13.939200: [TUN] [OneVPS] Enabling firewall rules
2020-10-11 14:00:13.998200: [TUN] [OneVPS] Dropping privileges
2020-10-11 14:00:13.998200: [TUN] [OneVPS] Creating interface instance
2020-10-11 14:00:13.999200: [TUN] [OneVPS] Routine: encryption worker - started
2020-10-11 14:00:14.000200: [TUN] [OneVPS] Routine: encryption worker - started
2020-10-11 14:00:14.001200: [TUN] [OneVPS] Routine: decryption worker - started
2020-10-11 14:00:14.001200: [TUN] [OneVPS] Routine: handshake worker - started
2020-10-11 14:00:14.001200: [TUN] [OneVPS] Routine: decryption worker - started
2020-10-11 14:00:14.002200: [TUN] [OneVPS] Routine: event worker - started
2020-10-11 14:00:14.002200: [TUN] [OneVPS] Routine: encryption worker - started
2020-10-11 14:00:14.002200: [TUN] [OneVPS] Routine: decryption worker - started
2020-10-11 14:00:14.002200: [TUN] [OneVPS] Routine: handshake worker - started
2020-10-11 14:00:14.002200: [TUN] [OneVPS] Routine: encryption worker - started
2020-10-11 14:00:14.002200: [TUN] [OneVPS] Routine: decryption worker - started
2020-10-11 14:00:14.002200: [TUN] [OneVPS] Routine: handshake worker - started
2020-10-11 14:00:14.002200: [TUN] [OneVPS] Routine: encryption worker - started
2020-10-11 14:00:14.002200: [TUN] [OneVPS] Routine: decryption worker - started
2020-10-11 14:00:14.003200: [TUN] [OneVPS] Routine: handshake worker - started
2020-10-11 14:00:14.003200: [TUN] [OneVPS] Routine: TUN reader - started
2020-10-11 14:00:14.003200: [TUN] [OneVPS] Routine: encryption worker - started
2020-10-11 14:00:14.003200: [TUN] [OneVPS] Routine: handshake worker - started
2020-10-11 14:00:14.003200: [TUN] [OneVPS] Routine: handshake worker - started
2020-10-11 14:00:14.003200: [TUN] [OneVPS] Routine: encryption worker - started
2020-10-11 14:00:14.003200: [TUN] [OneVPS] Routine: decryption worker - started
2020-10-11 14:00:14.003200: [TUN] [OneVPS] Routine: decryption worker - started
2020-10-11 14:00:14.004200: [TUN] [OneVPS] Routine: handshake worker - started
2020-10-11 14:00:14.004200: [TUN] [OneVPS] Routine: handshake worker - started
2020-10-11 14:00:14.004200: [TUN] [OneVPS] Routine: encryption worker - started
2020-10-11 14:00:14.004200: [TUN] [OneVPS] Routine: decryption worker - started
2020-10-11 14:00:14.004200: [TUN] [OneVPS] Setting interface configuration
2020-10-11 14:00:14.005200: [TUN] [OneVPS] UAPI: Updating private key
2020-10-11 14:00:14.005200: [TUN] [OneVPS] UAPI: Removing all peers
2020-10-11 14:00:14.006200: [TUN] [OneVPS] UAPI: Transition to peer configuration
2020-10-11 14:00:14.006200: [TUN] [OneVPS] peer(WrUw…B4VY) - UAPI: Created
2020-10-11 14:00:14.006200: [TUN] [OneVPS] peer(WrUw…B4VY) - UAPI: Updating endpoint
2020-10-11 14:00:14.007200: [TUN] [OneVPS] peer(WrUw…B4VY) - UAPI: Updating persistent keepalive interval
2020-10-11 14:00:14.008200: [TUN] [OneVPS] peer(WrUw…B4VY) - UAPI: Removing all allowedips
2020-10-11 14:00:14.008200: [TUN] [OneVPS] peer(WrUw…B4VY) - UAPI: Adding allowedip
2020-10-11 14:00:14.008200: [TUN] [OneVPS] Bringing peers up
2020-10-11 14:00:14.015200: [TUN] [OneVPS] Routine: receive incoming IPv6 - started
2020-10-11 14:00:14.016200: [TUN] [OneVPS] Routine: receive incoming IPv4 - started
2020-10-11 14:00:14.016200: [TUN] [OneVPS] UDP bind has been updated
2020-10-11 14:00:14.016200: [TUN] [OneVPS] peer(WrUw…B4VY) - Starting...
2020-10-11 14:00:14.016200: [TUN] [OneVPS] peer(WrUw…B4VY) - Routine: sequential receiver - started
2020-10-11 14:00:14.016200: [TUN] [OneVPS] peer(WrUw…B4VY) - Routine: nonce worker - started
2020-10-11 14:00:14.017200: [TUN] [OneVPS] peer(WrUw…B4VY) - Routine: sequential sender - started
2020-10-11 14:00:14.017200: [TUN] [OneVPS] peer(WrUw…B4VY) - Sending keepalive packet
2020-10-11 14:00:14.017200: [TUN] [OneVPS] Monitoring default v6 routes
2020-10-11 14:00:14.017200: [TUN] [OneVPS] peer(WrUw…B4VY) - Sending handshake initiation
2020-10-11 14:00:14.018200: [TUN] [OneVPS] Binding v6 socket to interface 23 (blackhole=false)
2020-10-11 14:00:14.019200: [TUN] [OneVPS] peer(WrUw…B4VY) - Awaiting keypair
2020-10-11 14:00:14.019200: [TUN] [OneVPS] Setting device v6 addresses
2020-10-11 14:00:14.418200: [TUN] [OneVPS] Monitoring default v4 routes
2020-10-11 14:00:14.418200: [TUN] [OneVPS] Binding v4 socket to interface 23 (blackhole=false)
2020-10-11 14:00:14.419200: [TUN] [OneVPS] Setting device v4 addresses
2020-10-11 14:00:14.546200: [TUN] [OneVPS] Listening for UAPI requests
2020-10-11 14:00:14.546200: [TUN] [OneVPS] Startup complete
2020-10-11 14:00:14.546200: [TUN] [OneVPS] Unable to set interface addresses, routes, dns, and/or interface settings: runNetsh run - exit status 1
2020-10-11 14:00:14.664200: [TUN] [OneVPS] Device closing
2020-10-11 14:00:14.664200: [TUN] [OneVPS] Routine: TUN reader - stopped
2020-10-11 14:00:15.311200: [TUN] [OneVPS] Routine: event worker - stopped
2020-10-11 14:00:15.311200: [TUN] [OneVPS] Routine: receive incoming IPv4 - stopped
2020-10-11 14:00:15.311200: [TUN] [OneVPS] Routine: receive incoming IPv6 - stopped
2020-10-11 14:00:15.311200: [TUN] [OneVPS] Routine: decryption worker - stopped
2020-10-11 14:00:15.311200: [TUN] [OneVPS] peer(WrUw…B4VY) - Stopping...
2020-10-11 14:00:15.311200: [TUN] [OneVPS] Routine: decryption worker - stopped
2020-10-11 14:00:15.312200: [TUN] [OneVPS] Routine: encryption worker - stopped
2020-10-11 14:00:15.312200: [TUN] [OneVPS] Routine: encryption worker - stopped
2020-10-11 14:00:15.312200: [TUN] [OneVPS] Routine: decryption worker - stopped
2020-10-11 14:00:15.312200: [TUN] [OneVPS] Routine: encryption worker - stopped
2020-10-11 14:00:15.313200: [TUN] [OneVPS] Routine: handshake worker - stopped
2020-10-11 14:00:15.313200: [TUN] [OneVPS] Routine: handshake worker - stopped
2020-10-11 14:00:15.313200: [TUN] [OneVPS] Routine: handshake worker - stopped
2020-10-11 14:00:15.313200: [TUN] [OneVPS] Routine: encryption worker - stopped
2020-10-11 14:00:15.313200: [TUN] [OneVPS] Routine: decryption worker - stopped
2020-10-11 14:00:15.313200: [TUN] [OneVPS] Routine: encryption worker - stopped
2020-10-11 14:00:15.313200: [TUN] [OneVPS] Routine: handshake worker - stopped
2020-10-11 14:00:15.313200: [TUN] [OneVPS] Routine: decryption worker - stopped
2020-10-11 14:00:15.313200: [TUN] [OneVPS] Routine: handshake worker - stopped
2020-10-11 14:00:15.314200: [TUN] [OneVPS] Routine: decryption worker - stopped
2020-10-11 14:00:15.314200: [TUN] [OneVPS] Routine: encryption worker - stopped
2020-10-11 14:00:15.314200: [TUN] [OneVPS] Routine: handshake worker - stopped
2020-10-11 14:00:15.314200: [TUN] [OneVPS] Routine: handshake worker - stopped
2020-10-11 14:00:15.314200: [TUN] [OneVPS] Routine: encryption worker - stopped
2020-10-11 14:00:15.314200: [TUN] [OneVPS] Routine: handshake worker - stopped
2020-10-11 14:00:15.314200: [TUN] [OneVPS] Routine: decryption worker - stopped
2020-10-11 14:00:15.314200: [TUN] [OneVPS] Routine: encryption worker - stopped
2020-10-11 14:00:15.314200: [TUN] [OneVPS] Routine: decryption worker - stopped
2020-10-11 14:00:15.315200: [TUN] [OneVPS] peer(WrUw…B4VY) - Routine: nonce worker - stopped
2020-10-11 14:00:15.315200: [TUN] [OneVPS] peer(WrUw…B4VY) - Routine: sequential receiver - stopped
2020-10-11 14:00:15.315200: [TUN] [OneVPS] peer(WrUw…B4VY) - Routine: sequential sender - stopped
2020-10-11 14:00:15.315200: [TUN] [OneVPS] Interface closed
2020-10-11 14:00:15.315200: [TUN] [OneVPS] Shutting down

I want to run some confidential program on a cloud server. In order to protect it from being copied, I can encrypt it into a drive and mount the decrypted drive to run it. However I want to umount the decrypted drive once it sets up running in memory to minimize the time window of the decryption.

Is it ever possible to do so? Or Linux locks this drive for the program is running from?

A similar situation is to run a program on a drive and then umount that drive.

It is weird that the /usr/lib/systemd/system/[email protected] is a simple task:

[Unit]
Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I
After=network.target

[Service]
Type=notify
PrivateTmp=true
ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/ --config %i.conf

[Install]
WantedBy=multi-user.target

However, when I tried to make a self-start openvpn script like autoinit.service with ExecStart=/bin/bash /root/setvpn.sh

Where as /root/setvpn.sh:

#!/bin/bash
/usr/sbin/openvpn --config /etc/openvpn/tun0.conf

Then this indirect start encounters a mistake：

# systemctl start autoinit
Warning: autoinit.service changed on disk. Run 'systemctl daemon-reload' to reload units.
# systemctl status autoinit
● autoinit.service - Sets up OpenVPN servers
   Loaded: loaded (/usr/lib/systemd/system/autoinit.service; enabled; vendor preset: disabled)
   Active: deactivating (stop-sigterm) since Fri 2020-05-15 18:54:50 CST; 12s ago
  Process: 10692 ExecStart=/root/setvpn.sh (code=exited, status=0/SUCCESS)
 Main PID: 10692 (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/autoinit.service
           └─10694 /usr/sbin/openvpn --config /etc/openvpn/tun0.conf

Actually if I run systemctl daemon-reload before start this autoinit service, it will halt and cannot start at all. Of course /root/setvpn.sh has no problem of execution, why is that systemctl cannot run it?

I am designing a security policy for a server program on Linux. I wish to reserve a tcp port number-say 8888, to and only to that executable of the program to listen to. Then I could turn the program files as r-x in nosudo user and allow only the port 8888 to be in and nothing out on firewall. (Might turn SSH in allow as well) . A trojan cannot spoof that program and hijack port 8888, or auto-connect to hacker's server.

Thus the whole three will leave hackers no vulnerability to attack except for those in the the program itself. Recent news that ASUS server has been hacked and installed trojans to many ASUS computers through fake updates, further proves the necessity of this policy.

However I have not found an application like ufw or SELinux to enforce the tcp port reserve policy. Is there a way to implement it?