Disabling Unused Services to Reduce Attack Surface

Every running service is a potential entry point for attackers. Disable anything you don't need.

List All Running Services

systemctl list-units --type=service --state=running

Check What Is Listening on the Network

ss -tulpn

Look for services listening on 0.0.0.0 (all interfaces) that should only be accessible locally.

Common Services to Evaluate

• avahi-daemon: mDNS — rarely needed on a server. Disable: systemctl disable avahi-daemon
• cups: Printing — not needed on a server. apt purge cups -y
• rpcbind: NFS RPC — disable if not using NFS. systemctl disable rpcbind
• snapd: Snap package manager — remove if not using snaps. apt purge snapd -y
• bluetooth: systemctl disable bluetooth

Restrict MySQL to Localhost

Edit /etc/mysql/mariadb.conf.d/50-server.cnf:

bind-address = 127.0.0.1

This prevents MySQL from listening on the public network.

Restrict Redis to Localhost

Edit /etc/redis/redis.conf:

bind 127.0.0.1

Remove Unused Packages

apt purge telnet rsh-client rsh-server ftp -y
apt autoremove -y

Audit After Changes

ss -tulpn   # Verify open ports reduced
ufw status  # Confirm firewall rules still make sense