5.2Host Security Configuration

The first principle of host defense: what is not running cannot be attacked. Stop unneeded services to shrink the attack surface, then narrow the remaining doors with a firewall—this two-layer basic is the section's core.

5.2.1Stopping services and blocking logins

• Current = systemctl: systemctl stop (now) plus systemctl disable (from next boot)—two steps. Inventory with systemctl list-unit-files --state=enabled.
• Legacy = service start/stop, chkconfig (RHEL-family autostart), and /etc/init.d/ scripts—the right answers in older-environment questions.
• inetd/xinetd are super-servers that spawn services on demand (config in /etc/inetd.conf, /etc/xinetd.d/). Superseded by systemd sockets, they appear as legacy entrances to disable.
• Shadow passwords isolate hashes in /etc/shadow (root-only; recap of 3.1). /etc/nologin: its mere existence blocks non-root logins (an instant maintenance gate; its content becomes the message shown).