What Is Listening?

What is this machine offering?

Two questions, and they are not the same one. What is running right now, and what will start again after a restart.

Running right now

sudo ss -tlnp

That prints one line per thing accepting connections. It looks busy, but you only need two parts of each line:

LISTEN  0  128  0.0.0.0:22   0.0.0.0:*  users:(("sshd",pid=812,...))
                │       │                         │
                │       └── the port              └── the program
                └────────── who can reach it

• The program name on the right is what matters. A port number on its own tells you almost nothing.
• 0.0.0.0 on the left means the whole network can reach it. 127.0.0.1 means only this machine can, which is a much smaller problem.

Starting on its own

systemctl list-unit-files --state=enabled

That lists everything set to start by itself. Read down it and look for something that is not a normal part of Ubuntu.

Turning one off

sudo systemctl disable --now NAME

--now matters. Without it you have only stopped the service until the next restart, when it comes straight back. That half-fix is one of the most common ways to lose a point you thought you had.

The decision, for every line

💡 Does the ReadMe say this machine provides this service? If yes, it stays. If no, it is a finding. That is the whole test, and turning off a required service costs you just as much as leaving a bad one running.

Try it yourself

sudo ss -tlnp                                 # what is accepting connections now
systemctl list-unit-files --state=enabled     # what starts on its own

For each one, name the program and decide: authorized, or not.