Harden UniFi Controller with systemd Sandboxing and Resource Limits

This systemd drop-in hardens the UniFi Network Controller service by applying sandboxing directives, restricting filesystem access, and capping memory. Internally, systemd creates a per-service cgroup and namespace; directives like ProtectSystem=strict remount the filesystem read-only except for explicitly allowed paths, while PrivateTmp and NoNewPrivileges prevent privilege escalation via temp files or setuid binaries. ReadWritePaths whitelists the UniFi data and log directories so the controller can still write its MongoDB files and logs. MemoryMax enforces a hard ceiling via cgroup v2 memory controller, causing OOM-kill on the service rather than the whole host if a runaway query occurs

In production this is essential on shared hosts, edge appliances, and any environment where the controller coexists with other services. It mitigates the blast radius of a controller compromise, which historically has been a target due to exposed management ports. It also stabilizes memory usage on small VMs, where MongoDB's default cache sizing can balloon and starve the OS. Pair it with a reverse proxy and firewall rules for defense in depth

Security and performance: ProtectSystem=strict can break the controller if it writes outside the allowed paths, so test in staging and check journalctl for permission denials. MemoryMax below the controller's steady-state working set will cause constant restarts, so baseline RSS first with systemd-cgtop. Common pitfalls include forgetting to allow access to /usr/lib/unifi/data, disabling PrivateDevices when the controller needs raw sockets, and applying the drop-in without daemon-reload, which silently does nothing

> System.Execute()

sudo mkdir -p /etc/systemd/system/unifi.service.d
sudo tee /etc/systemd/system/unifi.service.d/hardening.conf >/dev/null <<'EOF'
[Service]
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
NoNewPrivileges=true
ReadWritePaths=/usr/lib/unifi/data /usr/lib/unifi/logs /var/log/unifi
MemoryMax=4G
MemoryHigh=3G
RestrictSUIDSGID=true
RestrictNamespaces=true
EOF
sudo systemctl daemon-reload
sudo systemctl restart unifi
systemctl show unifi -p MemoryMax -p ProtectSystem

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-6BD07653801A