Ensure only authorized services are enabled
authorized-enabled-services · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
A host must run only the services the site declared essential. The essential set is a statement about what this system is for, so it cannot be derived from the host: an operator declares it in the authorized_services variable, as systemd unit names without the .service suffix. Until it is declared the check reports that it cannot assess the host and names what to set.
Rationale
Rules that disable one named service at a time reduce the count but never establish that what remains is what the site intended, because each can only forbid something somebody already thought of. The services that matter are the ones nobody chose: a package enabled its unit on install, a test left one behind, an engineer turned something on to debug and never turned it off. None of those has a rule written against it, and each is a running process with an attack surface. Comparing what is enabled against what was declared is the only form of this check that answers the objective as written.
Check → Remediate
- observed_command:
- systemctl list-unit-files --state=enabled --type=service --no-legend 2>/dev/null | awk '{print $1}' | sed 's/\.service$//' | sort -u
- authorized:
- {{ authorized_services }}
- note:
- For each service reported as not authorized, decide which side is wrong. If it is not needed, disable it (systemctl disable --now <unit>) and mask it if something might re-enable it. If it is needed, add it to authorized_services so the declared set matches what this system is for. Kensa does not disable services automatically here: the same finding can mean an unwanted service or an out-of-date list, and disabling the wrong unit can take the host off the network or end the session applying the change.
Framework references
NIST 800-53
NIST 800-171
CMMC Level 2