anchor.diff:  [indent=0,subs="verbatim,quotes,attributes"]
   ----
   	$ update-rc.d myapp defaults <priority>
  +----
  +
  +[[deployment-initd-service-securing]]
  +===== Securing an init.d service
  +
  +NOTE: The following is a set of guidelines on how to secure a Spring Boot application
  +that's being run as an init.d service. It is not intended to be an exhaustive list of
  +everything that should be done to harden an application and the environment in which it
  +runs.
  +
  +When executed as root, as is the case when root is being used to start an init.d service,
  +the default executable script will run the application as the user which owns the jar
  +file. You should never run a Spring Boot application as `root` so your application's jar
  +file should never be owned by root. Instead, create a specific user to run your
  +application and use `chown` to make it the owner of the jar file. For example:
  +
  +[indent=0,subs="verbatim,quotes,attributes"]
  +----
  +	$ chown bootapp:bootapp your-app.jar
  +----
  +
  +In this case, the default executable script will run the application as the `bootapp`
  +user.
  +
  +TIP: To reduce the chances of the application's user account being compromised, you should
  +consider preventing it from using a login shell. Set the account's shell to
  +`/usr/sbin/nologin`, for example.
  +
  +You should also take steps to prevent the modification of your application's jar file.
  +Firstly, configure its permissions so that it cannot be written and can only be read or
  +executed by its owner:
  +
  +[indent=0,subs="verbatim,quotes,attributes"]
  +----
  +	$ chmod 500 your-app.jar
  +----
  +
  +Secondly, you should also take steps to limit the damage if your application or the
  +account that's running it is compromised. If an attacker does gain access, they could make
  +the jar file writable and change its contents. One way to protect against this is to make
  +it immutable using `chattr`:
  +
  +[indent=0,subs="verbatim,quotes,attributes"]
  +----
  +	$ sudo chattr +i your-app.jar
  +----
  +
  +This will prevent any user, including root, from modifying the jar.
  +
  +If root is used to control the application's service and you
  +<<deployment-script-customization-conf-file, use a `.conf` file>> to customize its
  +startup, the `.conf` file will be read and evaluated by the root user. It should be
  +secured accordingly. Use `chmod` so that the file can only be read by the owner and use
  +`chown` to make root the owner:
  +
  +[indent=0,subs="verbatim,quotes,attributes"]
  +----
  +	$ chmod 400 your-app.conf
  +	$ sudo chown root:root your-app.conf
   ----
   
   
  
positive.code: `.conf` rather than `.jar`. For example, a jar named `/var/myapp/myapp.jar` will use the
  configuration file named `/var/myapp/myapp.conf` if it exists.
  
  
  
  [[deployment-windows]]
  
negative.code: https://github.com/kohsuke/winsw[`winsw`].
  
  A sample https://github.com/snicoll-scratches/spring-boot-daemon[maintained separately]
  to the core of Spring Boot describes step-by-step how you can create a Windows service for
  your Spring Boot application.
  
  
  
  