Howto: Disable and enable services in Jessie (systemd)

Message

#1 Post by **Hallvor** » 2015-04-04 17:22

A service is an application (or set of applications) that runs in the background waiting to be used, or carrying out essential tasks. Some of these may be listening for incoming connections that request the service, allowing external computers to connect to yours. Services are sometimes vulnerable (i.e. can be compromised under a given attack) and hence may present a security risk. In addition to this, services may take up precious resources. The best thing is therefore to disable all the services you don't need.

https://www.debian.org/doc/manuals/secu ... .html#s3.5

Warning: Disabling needed services will make your computer disbehave. Don't disable a service unless you know what you are doing!

To list your running services:

Code: Select all

$ systemctl

This may give you an output like this:

Code: Select all

  acpi-support.service                                                                     loaded active exited    LSB: Start some power management scripts                                                                                                                    
  acpid.service                                                                            loaded active running   ACPI event daemon                                                                                                                                           
  alsa-utils.service                                                                       loaded active exited    LSB: Restore and store ALSA driver settings                                                                                                                 
  atd.service                                                                              loaded active running   Deferred execution scheduler                                                                                                                                
  avahi-daemon.service                                                                     loaded active running   Avahi mDNS/DNS-SD Stack                                                                                                                                     
  console-kit-daemon.service                                                               loaded active running   Console Manager                                                                                                                                                                                                                                                                        
  console-setup.service                                                                    loaded active exited    LSB: Set console font and keymap                                                                                                                            
  cpufrequtils.service                                                                     loaded active exited    LSB: set CPUFreq kernel parameters                                                                                                                          
  cron.service                                                                             loaded active running   Regular background program processing daemon                                                                                                                
  cups-browsed.service                                                                     loaded active running   Make remote CUPS printers available locally                                                                                                                 
  cups.service                                                                             loaded active running   CUPS Printing Service                                                                                                                                       
  dbus.service                                                                             loaded active running   D-Bus System Message Bus                                                                                                                                    
  getty@tty1.service                                                                       loaded active running   Getty on tty1                                                                                                                                               
  hdparm.service                                                                           loaded active exited    LSB: Tune IDE hard disks                                                                                                                                    
  irqbalance.service                                                                       loaded active running   LSB: daemon to balance interrupts for SMP systems                                                                                                           
  kbd.service                                                                              loaded active exited    LSB: Prepare console                                                                                                                                        
  kdm.service                                                                              loaded active running   LSB: X display manager for KDE                                                                                                                              
  keyboard-setup.service                                                                   loaded active exited    LSB: Set preliminary keymap                                                                                                                                 
  kmod-static-nodes.service                                                                loaded active exited    Create list of required static device nodes for the current kernel                                                                                          
  lm-sensors.service                                                                       loaded active exited    Initialize hardware monitoring sensors                                                                                                                      
  loadcpufreq.service                                                                      loaded active exited    LSB: Load kernel modules needed to enable cpufreq scaling                                                                                                   
  ModemManager.service                                                                     loaded active running   Modem Manager                                                                                                                                               
  netfilter-persistent.service                                                             loaded active exited    netfilter persistent configuration                                                                                                                          
  networking.service                                                                       loaded active exited    LSB: Raise network interfaces.
  NetworkManager.service

The list on the left side contains the installed services. In the middle we see the status, e.g. whether they are running or not. On the right side is a short explanation of what the service actually does.

Here I have already removed the exim4 mail server, but since I don't have a printer attached to the computer, I also want to disable the cups.service. Since I don't attack a modem to this computer, I also want to disable the ModemManager.service.

Disabling services is done with the systemctl disable foo command, like this:

Code: Select all

root@debian:/home/hallvor# systemctl disable cups.service
Synchronizing state for cups.service with sysvinit using update-rc.d...
Executing /usr/sbin/update-rc.d cups defaults
Executing /usr/sbin/update-rc.d cups disable
insserv: warning: current start runlevel(s) (empty) of script `cups' overrides LSB defaults (2 3 4 5).
insserv: warning: current stop runlevel(s) (1 2 3 4 5) of script `cups' overrides LSB defaults (1).
Removed symlink /etc/systemd/system/paths.target.wants/cups.path.
Removed symlink /etc/systemd/system/sockets.target.wants/cups.socket.

This will prevent cups.service to start at boot.

If I want to stop the service immediately, I can use the systemctl stop foo command:

Code: Select all

root@debian:/home/hallvor# systemctl stop cups.service
Warning: Stopping cups.service, but it can still be activated by:
  cups.socket
  cups.path

The service is now disabled and stopped.

Now I will disable and stop the ModemManager.service in the same manner:

Code: Select all

root@debian:/home/hallvor# systemctl disable ModemManager.service
Removed symlink /etc/systemd/system/dbus-org.freedesktop.ModemManager1.service.
Removed symlink /etc/systemd/system/multi-user.target.wants/ModemManager.service.
root@debian:/home/hallvor# systemctl stop ModemManager.service
root@debian:/home/hallvor#

Running systemctl again will show that the two services have stopped.

To check the status of a service, we can type systemctl status foo, like this:

Code: Select all

root@debian:/home/hallvor# systemctl status cups.service
● cups.service - CUPS Printing Service
   Loaded: loaded (/lib/systemd/system/cups.service; disabled)
   Active: inactive (dead) since la. 2015-04-04 18:38:16 CEST; 28min ago
     Docs: man:cupsd(8)
           man:cupsd.conf(5)
 Main PID: 814 (code=exited, status=0/SUCCESS)
root@debian:/home/hallvor#

The cups service is disabled.

If we want to activate services again, for instance if I connect the computer to a printer and want the cups service back, it is just as easy with the systemctl enable foo parameter:

Code: Select all

root@debian:/home/hallvor# systemctl enable cups.service
Synchronizing state for cups.service with sysvinit using update-rc.d...
Executing /usr/sbin/update-rc.d cups defaults
insserv: warning: current start runlevel(s) (empty) of script `cups' overrides LSB defaults (2 3 4 5).
insserv: warning: current stop runlevel(s) (1 2 3 4 5) of script `cups' overrides LSB defaults (1).
Executing /usr/sbin/update-rc.d cups enable
Created symlink from /etc/systemd/system/sockets.target.wants/cups.socket to /lib/systemd/system/cups.socket.
Created symlink from /etc/systemd/system/paths.target.wants/cups.path to /lib/systemd/system/cups.path.
root@debian:/home/hallvor#

And to start it immediately we can use the systemctl start foo command:

Code: Select all

root@debian:/home/hallvor# systemctl start cups.service
root@debian:/home/hallvor#

Checking if the service is enabled or not can of course be done with the systemctl command, or we can use the systemctl is-enabled foo command to view the status of that single service:

Code: Select all

root@debian:/home/hallvor# systemctl is-enabled cups.service
enabled
root@debian:/home/hallvor#

If I for some reason want to restart a service, this can be done with the systemctl restart foo command:

Code: Select all

root@debian:/home/hallvor# systemctl restart cups.service
root@debian:/home/hallvor#