How to Audit and Remove Unnecessary Services

Why Remove Services?

Every running service is a potential attack surface. Minimizing installed services reduces security risk and frees system resources.

List Running Services

# All running services
systemctl list-units --type=service --state=running

# All listening ports
ss -tlnp

# All enabled services (start on boot)
systemctl list-unit-files --type=service --state=enabled

Common Unnecessary Services

Disable a Service

# Stop and disable
sudo systemctl stop avahi-daemon
sudo systemctl disable avahi-daemon

# Mask to prevent accidental re-enabling
sudo systemctl mask avahi-daemon

Remove Unnecessary Packages

# Ubuntu/Debian
sudo apt remove --purge snapd avahi-daemon cups
sudo apt autoremove

# Rocky/Alma
sudo dnf remove avahi cups

Restrict Existing Services

For services you cannot remove, restrict their exposure:

# Bind to localhost only (e.g., MySQL)
bind-address = 127.0.0.1

# Use firewall to block external access
sudo ufw deny 3306

Regular Auditing

# Run monthly
ss -tlnp | grep -v "127.0.0.1\|::1" > /tmp/open-ports.txt
# Review for unexpected listeners