# Built-in spyware in systemd

## DNS Fallback Servers

If your DNS cannot resolve hostname, systemd is preconfigured to **send hostnames to CloudFlare, Google and Quad9** servers, leaking your IP address and DNS queries to third parties.

Values that are hardcoded in `meson_options.txt:373`:

## NTP

systemd is preconfigured to **connect to a Google every 32 seconds** when initially syncing or correcting drift, and then **every 34 minutes** when clock is stable. These connections expose information about your machine, such as IP address and your timezone.

To check if this is enabled, run `timedatectl status`

Pay attention to this line: `Network time on: yes`, it will output `Network time on: yes/no`. My computer clock is running well, so I prefer to disable this feature altogether: `sudo timedatectl set-ntp false`.

Values that are hardcoded in `timesyncd-manager.h:17-18`:

• * `time1.google.com`
• * `time2.google.com`
• * `time3.google.com`
• * `time4.google.com`

## Log journal

systemd is preconfigured to store history of your interactions with the computer. Default log file size is set to 10% of your disk space, capped at max 4 GiB. This can store decades worth of activity logs (logs are compressed).

You can check what systemd has recorded with these commands:

1. * Computer start-up history: `journalctl --list-boots`
2. * User login, power button, lid history: `journalctl -u systemd-logind.service`

To reduce the amount of data systemd collects, you can either:

1. *

   change maximum log size by editing `/etc/systemd/journald.conf` file (example: `SystemMaxUse=1M` limits the log file to 10Mb instead of 4Gb);

2. *

   Clean logs at every startup/shutdown by adding this command to your `~/.bashrc` file: `sudo journalctl --vacuum-time=1day` (requires passwordless sudo).