Now another really simple thing that we can do to begin with on
a new machine is remove unneeded services.
We can take a look at the services that are running and
decide whether or not we need it.
We also should validate that we have got our mandatory
access control list running, so this is going to vary
dependent on the system that we're using,
but on an Ubuntu system, we should be expecting to see AppArmor up and running.
Now again,
we can concentrate on our Ubuntu system, and if we go back and just
take a look at our systemctl and status command again,
this is really good because we're able to see what services are running
at the moment. Scrolling through, we can see we've got the at daemon
running, atd.service. Now whilst this is okay,
we may not need it,
we might need things like the cron service for scheduling regular tasks,
but maybe not the at daemon, where we can specify we need a
certain task to run at a specific time.
They're usually for the one‑off jobs.
So if we don't need it,
we shouldn't have the service running, and maybe we
shouldn't even have it installed.
So let's go through and investigate what we can do.
The first thing is to disable the service, so systemctl
disable, so it won't auto start, ‑‑now,
so it stops now, and then our service name, atd.
Now this is good because we're not then using resource on our system; however,
if we don't actually need it, then perhaps we should remove the
service, but we might also not know the name of the package that
delivered our at daemon. If we use dpkg ‑S and search then for atd,
this is searching for the file atd.
We get then some results coming back, these are files with atd in its name,
but it's quite easy to see then the at package, the Linux headers is
obviously just something that doesn't match what we need.
So I can go through then and use sudo apt and purge, and
we can purge (remove) our at package.
It's also warning me about a package that was automatically
installed that we'll no longer need, so we can make sure
that we do remove that as well.
But as we then go through and process this,
we're able then to tidy up services that we no longer want.
Don't forget about that auto remove, that's another thing that we should be
very careful of, leaving packages that we no longer want.
They were installed automatically, but we've removed those dependency
packages so we need to auto remove those packages.
If I just run apt autoremove,
it's going to look at packages that were installed automatically but are
still on the system. So that's good, we're up and running as far as this
is concerned, but we also need to make sure that we are running our
mandatory access control lists, and they're going to be things like our
SELinux or our AlmaLinux system,
but AppArmor when we're taking a look at our Ubuntu system.
So as we go through and take a look, apparmor_status,
well, it's good,
we get a lot of information coming back. But if we go through
and take a look at the top of the output,
we should be able to see the profiles that we have loaded, so 28,
and all of these profiles are in enforce mode.
So this is the way that we want.
Now again,
there might be more protection that we want other than just the default, but at least we know now that AppArmor is loaded and in enforcing mode.