System Services, the Boot Process, and Attack Surface Reduction

Objective. Students use systemd to manage services and reduce the attack surface of a Linux server by disabling unnecessary daemons and applying CIS Benchmark controls.

What Is the Attack Surface?

Every program running on a Linux server is a potential entry point for an attacker. The attack surface is the total set of points where an unauthorized user could try to enter or extract data. One of the most effective ways to shrink the attack surface is to stop running software you do not need. This lesson focuses on how Linux starts its services and how you use systemd to turn off the ones that should not be running.

The Linux Boot Process and systemd

Modern Linux distributions — including Ubuntu, Debian, Fedora, and RHEL-family systems — use systemd as the first process started by the kernel (PID 1). systemd reads unit files stored in `/lib/systemd/system/` and `/etc/systemd/system/`, then brings targets up in order. Key milestones are:

1. sysinit.target — mounts file systems, initializes the kernel, starts `systemd-journald` (the logging daemon).

2. basic.target — starts sockets, timers, and other low-level units.

3. network-online.target — waits until at least one network interface is fully configured before dependent services start.

4. multi-user.target — starts most server daemons (SSH, cron, web servers, etc.) and getty units that provide console login prompts.

5. graphical.target — adds a display manager if a GUI is installed (generally absent on servers).

Understanding this sequence matters because attackers who gain a foothold often plant persistence mechanisms that hook into one of these targets so their code survives a reboot.

Why Unnecessary Services Are Dangerous

Every enabled service:

opens network ports or Unix sockets that could be exploited;
runs with some level of privilege;
introduces a code base that may contain unpatched vulnerabilities;
adds log noise that can mask malicious activity.

Disabling a service you do not use costs nothing in capability and reduces all four risks simultaneously.

The CIS Benchmark as Your Checklist

The Center for Internet Security (CIS) publishes free benchmarks for major Linux distributions. The CIS Ubuntu Linux Benchmark lists specific services that should be disabled on a general-purpose server — for example, `avahi-daemon` (zero-configuration networking, unnecessary in most server environments), `cups` (print service), `isc-dhcp-server`, `nfs-server`, `rpcbind`, and others. The benchmark assigns each control a level (Level 1 = practical minimum; Level 2 = high-security environments) and explains the rationale. Always cross-reference the benchmark against your organization's actual needs before disabling anything in production.

Managing Services with systemctl

`systemctl` is the command-line tool for interacting with systemd. Core operations:

| Goal | Command |

|---|---|

| List all running services | `systemctl list-units --type=service --state=running` |

| Show service status | `systemctl status <service>` |

| Stop a service immediately | `systemctl stop <service>` |

| Prevent it from starting on boot | `systemctl disable <service>` |

| Do both at once | `systemctl disable --now <service>` |

| Confirm it is truly off | `systemctl is-enabled <service>` and `systemctl is-active <service>` |

After a reboot, re-run `is-enabled` and `is-active` for every service you disabled. If a service is still active after a reboot, something else may have re-enabled it — which is itself a red flag worth investigating.

Persistence and MITRE ATT&CK

The MITRE ATT&CK framework documents real-world adversary tactics and techniques. Tactic TA0003 (Persistence) covers how attackers ensure their access survives reboots and credential changes. Three systemd-related persistence points are frequently abused:

systemd-journald: Attackers have tampered with journal configuration or replaced binaries to suppress log entries that would reveal their activity. Technique category: defense evasion combined with persistence.
getty units: A getty process manages a console login prompt. Malicious unit files have been observed that replace or supplement getty to spawn a backdoor shell on a virtual terminal. This maps to techniques under TA0003 involving system services.
network-online.target: Services that wait for the network are natural candidates for a rogue unit file an attacker drops after initial access, because the service starts automatically once network connectivity is confirmed — useful for beaconing to a command-and-control server.

Always verify unit file contents in `/etc/systemd/system/` and watch for unit files you did not create.

Safety Considerations

Although cybersecurity work is performed in a digital environment rather than a physical shop, professional safety discipline still applies:

Work on VMs, never production systems, when learning to disable services. A mistake that takes down a critical daemon on a live server can cause an outage.
Document every change before you make it. Run `systemctl status <service>` and capture the output so you can reverse your steps if needed.
Follow the principle of least privilege: use `sudo` only for the specific commands that require root; do not conduct the entire session as root.
Keep backups of unit files before editing them (`cp /etc/systemd/system/myunit.service ~/myunit.service.bak`).

Key terms9

systemdThe init system and service manager used by most modern Linux distributions; it is the first process started by the kernel (PID 1) and manages the entire service lifecycle.

unit fileA plain-text configuration file that tells systemd how to start, stop, and manage a service, socket, timer, or other resource.

attack surfaceThe total set of points — open ports, running processes, exposed APIs, enabled accounts — through which an attacker could attempt unauthorized access or data extraction.

CIS BenchmarkA set of security configuration guidelines published by the Center for Internet Security; benchmarks exist for major operating systems and provide specific, rationale-backed controls for hardening systems.

daemonA background process on a Linux system that runs continuously to provide a service (for example, sshd for SSH access or cron for scheduled tasks).

MITRE ATT&CKA publicly maintained knowledge base of adversary tactics, techniques, and procedures based on real-world observations; used by defenders to map threats and assess security controls.

TA0003 PersistenceThe MITRE ATT&CK tactic that describes techniques adversaries use to maintain their foothold across system restarts, credential changes, and other interruptions.

gettyA program that manages a terminal login prompt on a Linux system; systemd spawns getty units for each virtual console defined in the system configuration.

network-online.targetA systemd synchronization target that signals when the system has achieved full network connectivity; services that depend on it will not start until this target is reached.

In class: List all running services with systemctl list-units --type=service --state=running; cross-reference against the CIS Ubuntu Linux Benchmark's list of services that should be disabled on a general-purpose server; produce a table of services to keep, disable, and investigate further. · Disable at least five unnecessary services identified in the previous activity using systemctl disable --now; confirm they do not restart after a VM reboot; document each service's function and the security rationale for disabling it. · Walk through the systemd boot sequence diagram provided by the instructor; identify three points in the boot process (systemd-journald, getty, network-online.target) where an attacker could achieve persistence; match each to a real-world technique from the MITRE ATT&CK framework (TA0003 Persistence).
Materials: Linux VM, systemctl, CIS Ubuntu Linux Benchmark PDF, MITRE ATT&CK website (attack.mitre.org), CompTIA CySA+ Study Guide (Threat and Vulnerability Management chapters)
Check: Instructor reviews the services table and systemctl output after reboot; pass = at least five unnecessary services correctly disabled and still off after reboot, and MITRE ATT&CK mappings are accurate.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.