services

Overview

Every running service is a potential entry point. A core hardening principle is to reduce the attack surface by running only necessary services and configuring them safely. This lesson covers service hardening on Linux.

Learning objectives

• Explain attack surface reduction via service management.
• Enumerate and disable unnecessary services.
• Apply least privilege to services.

Core concept

Services (daemons) run in the background and often listen on the network, so each one is a possible target. Service hardening means:

• Disable/remove services you do not need — every unused listening service is needless exposure.
• Run services with least privilege — under dedicated, unprivileged accounts, not root.
• Bind services to the minimum interfaces — local-only where external access is unnecessary (127.0.0.1 vs 0.0.0.0).
• Manage services with systemctl (status, disable, stop, mask).

How it works

You first enumerate what is running and listening (systemctl list-units --type=service, and ss -tulpn for listening ports), then question each: is it needed? If not, stop and disable it (systemctl disable --now <svc>), removing that exposure entirely. For services you keep, ensure they run as a confined account and listen only where required. Attack surface reduction is powerful precisely because a service that is not running cannot be attacked — the most reliable defense of all.

Practical example

An audit with ss -tulpn shows an old, unused FTP service listening on 0.0.0.0:21. Since it is not needed, hardening removes the exposure entirely: sudo systemctl disable --now vsftpd (and optionally uninstalling it). A database that only local apps use but is bound to all interfaces is reconfigured to listen on 127.0.0.1. Each change eliminates or narrows a potential entry point.

Cybersecurity relevance

Attack surface reduction is a foundational hardening strategy and a frequent assessment theme: unnecessary or misconfigured services (exposed databases, legacy protocols, admin interfaces reachable from the internet) are common footholds. Disabling what is not needed and confining what is directly lowers the number of ways in and limits the impact if a service is compromised. This complements the firewall/segmentation controls from the networking path — defense at the host-service level.

Common mistakes

• Leaving unused services running/listening, needlessly enlarging the attack surface.
• Running services as root when a confined account would do.
• Binding services to all interfaces (0.0.0.0) when local-only would suffice.

Key takeaways

• Each running, listening service is a potential entry point; hardening reduces attack surface by disabling unneeded services.
• Enumerate services (systemctl, ss -tulpn), disable what is not needed (systemctl disable --now), and run the rest with least privilege on minimal interfaces.
• A service that is not running cannot be attacked — attack surface reduction is among the most reliable defenses and a common assessment focus.

Check your understanding

• Why is disabling an unnecessary service one of the most reliable hardening actions?
• Besides disabling unused services, name two ways to harden a service you must keep running.