list of linux services that really aren't needed in a linux guest

[marvinb]

I am running a RHEL 5.3 guest in 3.5.

This is our first RHEL 5 guest. Are there any services thar really arent needed in a a vmware esx environment?

acpid 0:off 1:off 2:on 3:on 4:on 5:on 6:off

anacron 0:off 1:off 2:on 3:on 4:on 5:on 6:off

apmd 0:off 1:off 2:on 3:on 4:on 5:on 6:off

atd 0:off 1:off 2:off 3:on 4:on 5:on 6:off

auditd 0:off 1:off 2:on 3:on 4:on 5:on 6:off

autofs 0:off 1:off 2:off 3:on 4:on 5:on 6:off

avahi-daemon 0:off 1:off 2:off 3:on 4:on 5:on 6:off

avahi-dnsconfd 0:off 1:off 2:off 3:off 4:off 5:off 6:off

bluetooth 0:off 1:off 2:on 3:on 4:on 5:on 6:off

conman 0:off 1:off 2:off 3:off 4:off 5:off 6:off

cpuspeed 0:off 1:on 2:on 3:on 4:on 5:on 6:off

crond 0:off 1:off 2:on 3:on 4:on 5:on 6:off

cups 0:off 1:off 2:on 3:on 4:on 5:on 6:off

firstboot 0:off 1:off 2:off 3:on 4:off 5:on 6:off

gpm 0:off 1:off 2:on 3:on 4:on 5:on 6:off

haldaemon 0:off 1:off 2:off 3:on 4:on 5:on 6:off

hidd 0:off 1:off 2:on 3:on 4:on 5:on 6:off

hplip 0:off 1:off 2:on 3:on 4:on 5:on 6:off

ip6tables 0:off 1:off 2:on 3:on 4:on 5:on 6:off

iptables 0:off 1:off 2:on 3:on 4:on 5:on 6:off

irqbalance 0:off 1:off 2:on 3:on 4:on 5:on 6:off

kudzu 0:off 1:off 2:off 3:on 4:on 5:on 6:off

lm_sensors 0:off 1:off 2:on 3:on 4:on 5:on 6:off

lvm2-monitor 0:off 1:on 2:on 3:on 4:on 5:on 6:off

mcstrans 0:off 1:off 2:on 3:on 4:on 5:on 6:off

mdmonitor 0:off 1:off 2:on 3:on 4:on 5:on 6:off

messagebus 0:off 1:off 2:off 3:on 4:on 5:on 6:off

microcode_ctl 0:off 1:off 2:on 3:on 4:on 5:on 6:off

netconsole 0:off 1:off 2:off 3:off 4:off 5:off 6:off

netfs 0:off 1:off 2:off 3:on 4:on 5:on 6:off

network 0:off 1:off 2:on 3:on 4:on 5:on 6:off

nfslock 0:off 1:off 2:off 3:on 4:on 5:on 6:off

nscd 0:off 1:off 2:on 3:on 4:on 5:on 6:off

ntpd 0:off 1:off 2:off 3:on 4:off 5:on 6:off

pcscd 0:off 1:off 2:on 3:on 4:on 5:on 6:off

portmap 0:off 1:off 2:off 3:on 4:on 5:on 6:off

readahead_early 0:off 1:off 2:on 3:on 4:on 5:on 6:off

readahead_later 0:off 1:off 2:off 3:off 4:off 5:on 6:off

restorecond 0:off 1:off 2:on 3:on 4:on 5:on 6:off

rhnsd 0:off 1:off 2:off 3:on 4:on 5:on 6:off

rpcgssd 0:off 1:off 2:off 3:on 4:on 5:on 6:off

rpcidmapd 0:off 1:off 2:off 3:on 4:on 5:on 6:off

sendmail 0:off 1:off 2:on 3:on 4:on 5:on 6:off

setroubleshoot 0:off 1:off 2:off 3:on 4:on 5:on 6:off

smartd 0:off 1:off 2:on 3:on 4:on 5:on 6:off

sshd 0:off 1:off 2:on 3:on 4:on 5:on 6:off

syslog 0:off 1:off 2:on 3:on 4:on 5:on 6:off

sysstat 0:off 1:off 2:on 3:on 4:off 5:on 6:off

vmware-tools 0:off 1:off 2:on 3:on 4:off 5:on 6:off

wdaemon 0:off 1:off 2:off 3:off 4:off 5:off 6:off

xfs 0:off 1:off 2:on 3:on 4:on 5:on 6:off

xinetd 0:off 1:off 2:off 3:on 4:on 5:on 6:off

yum-updatesd 0:off 1:off 2:on 3:on 4:on 5:on 6:off

[petedr]

In my experience with Linux VMs there hasn't been anything we have turned off specifically because the machine is now virtual instead of being a physical. I would think the decision of what services are needed is based on the functional requirements of the server itself. Definitely run the vmware-tools service as that is something just for vmware.

[mcowger]

Only one I would drop is bluetooth.

--Matt

VCP, vExpert, Unix Geek

[Texiwill · Accepted solution]

Hello,

I would check out the CISecurity (http://cisecurity.org) RHEL5 benchmark for a full list of what can be disabled.

Best regards,
Edward L. Haletky
VMware Communities User Moderator, VMware vExpert 2009
====
Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education.
Blue Gears and SearchVMware Pro Blogs -- Top Virtualization Security Links -- Virtualization Security Round Table Podcast

[SuryaVMware]

smartd, That is because the VMware Virtual HDD won't support it. But if you VM is configured with RDM then i would say leave the smartd on.

-Surya

[marvinb]

This is a great resource and very helpful.

I was looking at what I could turn off with respect to the fact that is was now a vm, such things as powermanagement,. hwbrowser stuff, etc.

This gives me a list of things I can turn off with respect to security. If i can turn off alot of this stuff, the other stuff would probably take care of itself.

[mtakeuchi]

Here are the ones I've disabled for CentOS 5 because they were unnecessary to a VM:

bluetooth - Bluetooth services (hcid & sdpd)

hidd - Bluetooth HID daemon

pcscd - PC/SC Smart Card Daemon

smartd - SMART Disk Monitoring daemon

ntpd - Network Time daemon (only if you have time sync to host set up)

I'm curious if apmd and acpid are necessary for a VM (it doesn't even seem like apmd runs). The only thing I can think of that acpid may be used for is the "Shutdown Guest" and "Restart Guest" commands.

-Mark

[Texiwill]

Hello,

Correct, everything that is 'hardware' related that I know about is actually in the 'security list' so disabling everything there will help with quite a few things.

Best regards,
Edward L. Haletky
VMware Communities User Moderator, VMware vExpert 2009
====
Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education.
Blue Gears and SearchVMware Pro Blogs -- Top Virtualization Security Links -- Virtualization Security Round Table Podcast

[kopper27]

these are the services I usually disable for Centos 5.6...Later I will be adding for Suse 11 SP1

apmd - Disable if the system is ACPI capable

bluetooth and hidd - bluetooth services

cups - printing services if not needed disable it

firstboot, readahead_early only needed the first time a system is configured

gpm - If mouse functionality in the console is not required, disable this service, this service wont affect X

hpiod, hpssd, hplip - provide extensive support for HP printers

ip6tables - iptables - if firewall services are not needed

iscsi - if not needed disable it

isdn - If an ISDN modem is not being used, disable this service.

mdmonitor - For Software RAID so not needed for servers

pcscd - Smart Card Reader Daemon

sendmail - postfix - mail services if not needed diable them

smartd - SMART Disk Monitoring daemon maybe needed when using RDMs

xfs - font server not really needed for Server Linux VMs in console mode

yum-updatesd - optional I usually disable it we only apply Service Pack o new versions

These are good guides to check out

http://webcache.googleusercontent.com/search?q=cache:rbsX0oqseCQJ:www.imminentweb.com/technologies/c...

http://www.linuxtutorialblog.com/post/tutorial-disabling-unused-daemons-to-speed-up-your-boot-sequen...

http://www.cyberciti.biz/faq/linux-default-services-which-are-enabled-at-boot/

[petedr]

Cool, thanks for posting your list.

Pete

------

www.liquidwarelabs.com

www.thevirtualheadline.com