A 2019 study found that the average Linux container image contains over 100 known vulnerabilities—most in packages the application never uses. Removing unnecessary packages and disabling unused services is the simplest and most effective hardening step. This lesson details how to create a minimal package manifest, disable and mask services with systemd, and build a lean OS image that passes vulnerability scanners.
Use package manager tools to list installed packages: dpkg -l (Debian), rpm -qa (RHEL), or zypper se --installed (SUSE). Identify packages that are not needed for the system's role: compilers (gcc), X11 libraries on a server, Bluetooth, CUPS, and legacy services like telnet. Remove with apt purge, yum remove, etc. For servers, install in 'minimal' mode at deployment and add only what's necessary.
# Purge a package and its dependencies (Debian/Ubuntu)
sudo apt purge --auto-remove telnetd rsh-server
# On RHEL/CentOS
sudo yum autoremove xinetd tftp-serverThe --auto-remove flag removes unused dependencies, further reducing the package footprint.
systemctl stop disables a running service, but it may be restarted by dependencies. systemctl disable prevents automatic startup at boot, but a dependency can still trigger it. systemctl mask creates a symlink to /dev/null, completely preventing the service from being started by any means—even manually. Use mask for critical-to-disable services like rpcbind, cups, avahi-daemon, and bluetooth on servers.
💡 To list all services and their state: systemctl list-units --type=service --all. Focus on those 'active' or 'inactive'—mask the unnecessary ones.
| Service | Potential Risk | Action on Server |
|---|---|---|
| cups (print) | Print spooler vulnerabilities | Mask/disable unless print server |
| avahi-daemon (mDNS) | Service discovery, mDNS spoofing | Mask/disable on servers |
| bluetooth | Wireless attack surface | Mask/disable, remove hardware if possible |
| rpcbind (NFS/portmap) | RPC enumeration | Disable if not using NFS |
Document the list of allowed packages and services in your configuration management (Ansible, Chef). Use tools like deborphan or rpmorphan to identify unused libraries and packages. Integrate a security scanner (e.g., Lynis) into your pipeline that flags unnecessary services. Over time, drift happens; schedule monthly package reviews.
⚠️ Removing system packages can break dependencies—always test in a staging environment. Use 'apt autoremove --simulate' or 'yum remove --setopt=tsflags=test' to preview.
Verify exercises to earn ★ 140 XP and unlock next lab level.