MigrationBot: Backfill (v3.0 review queue): added to the review queue

2026-09-22T05:42:42Z

Backfill (v3.0 review queue): added to the review queue

← Older revision		Revision as of 05:42, 22 September 2026
Line 50:		Line 50:
	[[Category:Linux Service Auditing\|027]]		[[Category:Linux Service Auditing\|027]]
	[[Category:Migrated from cypat.guide]]		[[Category:Migrated from cypat.guide]]
			[[Category:Pending review]]

MigrationBot: Import from cypat.guide: docs/linux/service_auditing/intermediate_service_auditing.md

2026-09-18T17:06:22Z

Import from cypat.guide: docs/linux/service_auditing/intermediate_service_auditing.md

New page

{{Submit}}

Author(s): Matthias Lee (ml2322) <br /> Last Updated: 7-17-2025

<br />
{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

Introduction to Service Auditing

|}

=== More robust service auditing techniques ===

==== Directly interact with systemd ====

A better way to look for unauthorized services is to look at ''all'' enabled services on the system, and see which ones are not supposed to be there. You can do this with <code>systemctl</code>:

<syntaxhighlight lang="text">user@system:~$ systemctl list-unit-files | less
UNIT FILE STATE VENDOR PRESET
proc-sys-fs-binfmt_misc.automount static enabled
-.mount generated enabled
boot-efi.mount generated enabled
dev-hugepages.mount static enabled
....
nginx.service enabled enabled</syntaxhighlight>
Here, we can see that I have <code>nginx</code> enabled.

==== Baselines ====

The one problem with the above solution is that it's tedious to look through every enabled service and see which aren't supposed to be there. The solution to this is to, on a clean machine of the same OS, export the systemctl services to a baseline:

<syntaxhighlight lang="text">user@clean-system:~$ systemctl list-unit-files > baseline.txt</syntaxhighlight>
You can then copy this file onto the machine you're working with. Now, on that machine, do the same command to export the current services to a list too:

<syntaxhighlight lang="text">user@system:~$ systemctl list-unit-files > services.txt</syntaxhighlight>
Now, you can use diff to compare them:

<syntaxhighlight lang="text">user@system:~$ diff baseline.txt services.txt
329a330
> nginx.service enabled enabled
380c381
< 377 unit files listed.
---
> 378 unit files listed.</syntaxhighlight>
And we see here that <code>nginx</code> is, again, enabled, and should be removed.

[[Category:Linux Service Auditing|027]]
[[Category:Migrated from cypat.guide]]

Draft:Intermediate Service Auditing - Revision history

MigrationBot: Backfill (v3.0 review queue): added to the review queue

MigrationBot: Import from cypat.guide: docs/linux/service_auditing/intermediate_service_auditing.md