System hardening
Disable unneeded services
Remove or stop packages, daemons, timers, and sockets the server does not need to reduce code, privileges, and exposed behavior.
8 minute lesson
Every running service adds code and configuration you must trust. If the product does not need it, remove the obligation.
Review enabled systemd units, installed server packages, scheduled jobs, and container workloads. Confirm ownership before disabling anything. Recheck listeners afterward and document services the application depends on.
A default image may enable a mail daemon the application never uses. Stopping it removes the listener now, while disabling or removing it prevents the next reboot from restoring exposure.
Check timers and sockets as well as services. A stopped unit can start again when its socket receives traffic or a scheduled timer fires after the review.
Save the enabled-unit and listener evidence for one unneeded service. Disable it, reboot the lab host, and prove the port stays closed while the application’s health checks still pass.
Lesson completed