MigrationBot: Backfill (v3.0 review queue): added to the review queue

2026-09-22T05:42:43Z

Backfill (v3.0 review queue): added to the review queue

← Older revision		Revision as of 05:42, 22 September 2026
Line 59:		Line 59:
	[[Category:Linux Service Auditing\|026]]		[[Category:Linux Service Auditing\|026]]
	[[Category:Migrated from cypat.guide]]		[[Category:Migrated from cypat.guide]]
			[[Category:Pending review]]

MigrationBot: Import from cypat.guide: docs/linux/service_auditing/intro_service_auditing.md

2026-09-18T17:06:23Z

Import from cypat.guide: docs/linux/service_auditing/intro_service_auditing.md

New page

{{Submit}}

Author(s): Matthias Lee (ml2322) <br /> Last Updated: 7-17-2025

<br />
{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None! This is an introductory article.

|}

=== What is a service? ===

A service is a background process managed by the init system, usually systemd. Services not only provice necessary functions for the system, like <code>NetworkManager</code> or <code>auditd</code>, but can also host servers like Apache, Nginx, SSH, and more.

=== Why is this important? ===

Auditing services is important, as unwanted services may be providing remote access or sensitive data to malicious actors. Even things like SSH or Apache should be removed if not necessary, as they increase the attack surface, and can be configured to grant remote access or exfiltrate data. While this is the most common way services are abused, services can also be created to run malicious code and take advantage of running in the background, and potentially with elevated privileges.

=== How to audit services ===

There are several ways to check for malicious services, each with different benefits and drawbacks.

==== nmap ====

<code>nmap</code> (Network Mapper) is a tool to scan a host and see what ports are open. However, you can also run it on yourself (<code>localhost</code>) and see what ports are open on your own machine. This is by far the easiest way to check if there is an unauthorized port open, indicating an unwanted service is present.

Nmap doesn't come preinstalled, so you will have to install it with <code>apt</code>:

<syntaxhighlight lang="text">user@system:~$ sudo apt install nmap</syntaxhighlight>
Once nmap is installed, you can run it on yourself to check for open ports:

<syntaxhighlight lang="text">user@system:~$ nmap localhost
Starting Nmap 7.80 ( https://nmap.org ) at 2025-07-17 10:23 PDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00018s latency).
Not shown: 993 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
139/tcp open netbios-ssn
445/tcp open microsoft-ds
631/tcp open ipp

Nmap done: 1 IP address (1 host up) scanned in 0.09 seconds </syntaxhighlight>
Here, we see that I have ports <code>22</code>, <code>80</code>, <code>139</code>, <code>445</code>, and <code>631</code> open. <code>139</code> and <code>445</code> are used for netbios discovery. These are managed by the <code>nmbd</code> service. This isn't inherently malicious and is standard on many systems, but you may want to disable it for extra security. However, <code>22</code> and <code>80</code> are used for SSH and HTTP respectively. You can disable services with systemctl, but outright removing the packages is better.

<syntaxhighlight lang="text">user@system:~$ sudo systemctl disable ssh
user@system:~$ sudo systemctl disable apache2
user@system:~$ sudo systemctl disable nginx</syntaxhighlight>
<syntaxhighlight lang="text">user@system:~$ sudo apt purge openssh-server
user@system:~$ sudo apt purge apache2
user@system:~$ sudo apt purge nginx-common</syntaxhighlight>
If you don't know the specific service running on a port, remove or disable all servers that could be running on that port.

[[Category:Linux Service Auditing|026]]
[[Category:Migrated from cypat.guide]]

Draft:Introduction to Service Auditing - Revision history

MigrationBot: Backfill (v3.0 review queue): added to the review queue

MigrationBot: Import from cypat.guide: docs/linux/service_auditing/intro_service_auditing.md