Lesson 3.3: Fewer services, smaller attack surface
Every running service is code that can be attacked, and every listening port is a door. The cheapest hardening there is: turn off what isn't needed, and bind what is needed only to the interfaces that need it. In the lab you match the server's listening services against the owners' list, disable a retired FTP server and an unused RPC service so they don't come back after a reboot, move MySQL from all interfaces to localhost, and verify with ss.
16 min
You will learn to
- Explain service minimisation
- Match running services against an inventory
- Stop and disable services with systemctl
- Bind a service to localhost
- Verify the result with ss
Key terms
- Service minimisation
- Running only the services a system's role needs.
- systemctl disable --now
- Stops a service immediately and prevents it from starting at boot.
- Bind address
- The local IP address a service listens on: 0.0.0.0 means all IPv4 interfaces, 127.0.0.1 only this machine.
- CMDB
- An inventory of systems, services and their owners.
← Private addresses, NAT and port forwarding · All lessons · Protecting sessions and cookies →