Every running service is a potential attack vector — disabling anything not genuinely needed reduces your server's overall attack surface with essentially no downside for services you're not actually using.
Why This Matters
A vulnerability in a service you don't even use is still a vulnerability on your server — the fewer active services, the fewer potential entry points for an attacker, and the less you need to monitor and patch.
Step 1 — List All Currently Running Services
systemctl list-units --type=service --state=runningStep 2 — Review Each One Critically
For each running service, ask: do I actually need this? Is it something I intentionally installed and use, or a default that came with the base image/template and isn't actually necessary for my use case?
Common Services Worth Reviewing on a Minimal VPS
| Service | Consider Disabling If |
|---|---|
| Printing services (cups) | You have no printing needs (virtually always true for a VPS) |
| Bluetooth services | No relevant hardware/use case on a VPS (virtually always true) |
| Avahi/mDNS | Not using local network service discovery |
| NFS/rpcbind | Not using NFS-based file sharing |
The specific set of unnecessary default services varies by base image/distribution — review your actual running services list rather than assuming any generic checklist perfectly matches your specific system.
Step 3 — Stop and Disable Unneeded Services
sudo systemctl stop SERVICE_NAME
sudo systemctl disable SERVICE_NAMEstop halts it immediately; disable prevents it from starting again on future boots — do both for a genuinely permanent removal from your running services.
Step 4 — Consider Uninstalling, Not Just Disabling
sudo apt purge PACKAGE_NAMEFor services you're confident you'll never need, fully removing the package (not just disabling the service) further reduces attack surface and eliminates any need to track/patch that software at all.
Step 5 — Verify Nothing Broke
After disabling a service, verify your actual applications/workflows still function correctly — some services have non-obvious dependencies; test thoroughly before considering the cleanup complete.
Checking Listening Ports as a Cross-Check
sudo ss -tulnpCross-reference actively listening ports against your list of intentionally-running services — anything listening that you don't recognize deserves investigation.
Being Cautious with Core System Services
Don't disable services fundamental to system operation (systemd-journald, systemd-logind, and similar core components) without understanding their specific purpose — focus this exercise on genuinely optional, unused services, not core system infrastructure.
Documenting What You Disabled and Why
Keep a record of what you disabled/removed and the reasoning — useful if you later need to troubleshoot something unexpected, or if a future you (or teammate) wonders why a particular service isn't running.
Common Errors
Disabled a service that turned out to be needed by something else — re-enable it (sudo systemctl enable --now SERVICE_NAME) and investigate the actual dependency before attempting removal again, if still desired.
Continue Reading
- How to Manage Services with systemd and systemctl
- How to Harden a Fresh Linux VPS in 15 Minutes
- How to Audit Installed Packages for Known Vulnerabilities
Browse more articles in Server Security & Hardening.
