Como identificar serviços desnecessários no Ubuntu 16.04 LTS

1

Estou configurando o servidor linode no Ubuntu 16.04 LTS. Ele estará executando apenas o servidor web com o WordPress.

Acredito que há alguns serviços que eu posso desativar para tornar o servidor mais rápido e provavelmente ainda mais seguro.

Há perguntas aqui sobre esse tópico, mas nenhuma resposta indicando exatamente qual serviço é seguro desativar.

Lista de serviço no servidor que recebi executando ls /lib/systemd/system/*.service /etc/systemd/system/*.service

/etc/systemd/system/sshd.service
/etc/systemd/system/syslog.service
/lib/systemd/system/accounts-daemon.service
/lib/systemd/system/apt-daily.service
/lib/systemd/system/[email protected]
/lib/systemd/system/bootlogd.service
/lib/systemd/system/bootlogs.service
/lib/systemd/system/bootmisc.service
/lib/systemd/system/checkfs.service
/lib/systemd/system/checkroot-bootclean.service
/lib/systemd/system/checkroot.service
/lib/systemd/system/console-getty.service
/lib/systemd/system/console-setup.service
/lib/systemd/system/console-shell.service
/lib/systemd/system/[email protected]
/lib/systemd/system/cron.service
/lib/systemd/system/cryptdisks-early.service
/lib/systemd/system/cryptdisks.service
/lib/systemd/system/dbus-org.freedesktop.hostname1.service
/lib/systemd/system/dbus-org.freedesktop.locale1.service
/lib/systemd/system/dbus-org.freedesktop.login1.service
/lib/systemd/system/dbus-org.freedesktop.network1.service
/lib/systemd/system/dbus-org.freedesktop.resolve1.service
/lib/systemd/system/dbus-org.freedesktop.timedate1.service
/lib/systemd/system/dbus.service
/lib/systemd/system/debug-shell.service
/lib/systemd/system/emergency.service
/lib/systemd/system/friendly-recovery.service
/lib/systemd/system/fuse.service
/lib/systemd/system/[email protected]
/lib/systemd/system/getty-static.service
/lib/systemd/system/halt.service
/lib/systemd/system/hostname.service
/lib/systemd/system/hwclock.service
/lib/systemd/system/[email protected]
/lib/systemd/system/initrd-cleanup.service
/lib/systemd/system/initrd-parse-etc.service
/lib/systemd/system/initrd-switch-root.service
/lib/systemd/system/initrd-udevadm-cleanup-db.service
/lib/systemd/system/keyboard-setup.service
/lib/systemd/system/killprocs.service
/lib/systemd/system/kmod.service
/lib/systemd/system/kmod-static-nodes.service
/lib/systemd/system/module-init-tools.service
/lib/systemd/system/motd.service
/lib/systemd/system/mountall-bootclean.service
/lib/systemd/system/mountall.service
/lib/systemd/system/mountdevsubfs.service
/lib/systemd/system/mountkernfs.service
/lib/systemd/system/mountnfs-bootclean.service
/lib/systemd/system/mountnfs.service
/lib/systemd/system/networking.service
/lib/systemd/system/plymouth-halt.service
/lib/systemd/system/plymouth-kexec.service
/lib/systemd/system/plymouth-log.service
/lib/systemd/system/plymouth-poweroff.service
/lib/systemd/system/plymouth-quit.service
/lib/systemd/system/plymouth-quit-wait.service
/lib/systemd/system/plymouth-read-write.service
/lib/systemd/system/plymouth-reboot.service
/lib/systemd/system/plymouth.service
/lib/systemd/system/plymouth-start.service
/lib/systemd/system/plymouth-switch-root.service
/lib/systemd/system/procps.service
/lib/systemd/system/quotaon.service
/lib/systemd/system/rc-local.service
/lib/systemd/system/rc.local.service
/lib/systemd/system/rc.service
/lib/systemd/system/rcS.service
/lib/systemd/system/reboot.service
/lib/systemd/system/rescue.service
/lib/systemd/system/resolvconf.service
/lib/systemd/system/rmnologin.service
/lib/systemd/system/rsync.service
/lib/systemd/system/rsyslog.service
/lib/systemd/system/sendsigs.service
/lib/systemd/system/[email protected]
/lib/systemd/system/setvtrgb.service
/lib/systemd/system/sigpwr-container-shutdown.service
/lib/systemd/system/single.service
/lib/systemd/system/ssh.service
/lib/systemd/system/[email protected]
/lib/systemd/system/stop-bootlogd.service
/lib/systemd/system/stop-bootlogd-single.service
/lib/systemd/system/systemd-ask-password-console.service
/lib/systemd/system/systemd-ask-password-plymouth.service
/lib/systemd/system/systemd-ask-password-wall.service
/lib/systemd/system/[email protected]
/lib/systemd/system/systemd-binfmt.service
/lib/systemd/system/systemd-bootchart.service
/lib/systemd/system/systemd-bus-proxyd.service
/lib/systemd/system/systemd-exit.service
/lib/systemd/system/systemd-fsckd.service
/lib/systemd/system/systemd-fsck-root.service
/lib/systemd/system/[email protected]
/lib/systemd/system/systemd-halt.service
/lib/systemd/system/[email protected]
/lib/systemd/system/systemd-hibernate.service
/lib/systemd/system/systemd-hostnamed.service
/lib/systemd/system/systemd-hwdb-update.service
/lib/systemd/system/systemd-hybrid-sleep.service
/lib/systemd/system/systemd-initctl.service
/lib/systemd/system/systemd-journald.service
/lib/systemd/system/systemd-journal-flush.service
/lib/systemd/system/systemd-kexec.service
/lib/systemd/system/systemd-localed.service
/lib/systemd/system/systemd-logind.service
/lib/systemd/system/systemd-machine-id-commit.service
/lib/systemd/system/systemd-modules-load.service
/lib/systemd/system/systemd-networkd-resolvconf-update.service
/lib/systemd/system/systemd-networkd.service
/lib/systemd/system/systemd-networkd-wait-online.service
/lib/systemd/system/systemd-poweroff.service
/lib/systemd/system/systemd-quotacheck.service
/lib/systemd/system/systemd-random-seed.service
/lib/systemd/system/systemd-reboot.service
/lib/systemd/system/systemd-remount-fs.service
/lib/systemd/system/systemd-resolved.service
/lib/systemd/system/systemd-rfkill.service
/lib/systemd/system/systemd-suspend.service
/lib/systemd/system/systemd-sysctl.service
/lib/systemd/system/systemd-timedated.service
/lib/systemd/system/systemd-timesyncd.service
/lib/systemd/system/systemd-tmpfiles-clean.service
/lib/systemd/system/systemd-tmpfiles-setup-dev.service
/lib/systemd/system/systemd-tmpfiles-setup.service
/lib/systemd/system/systemd-udevd.service
/lib/systemd/system/systemd-udev-settle.service
/lib/systemd/system/systemd-udev-trigger.service
/lib/systemd/system/systemd-update-utmp-runlevel.service
/lib/systemd/system/systemd-update-utmp.service
/lib/systemd/system/systemd-user-sessions.service
/lib/systemd/system/udev.service
/lib/systemd/system/ufw.service
/lib/systemd/system/umountfs.service
/lib/systemd/system/umountnfs.service
/lib/systemd/system/umountroot.service
/lib/systemd/system/unattended-upgrades.service
/lib/systemd/system/urandom.service
/lib/systemd/system/ureadahead.service
/lib/systemd/system/ureadahead-stop.service
/lib/systemd/system/[email protected]
/lib/systemd/system/uuidd.service
/lib/systemd/system/x11-common.service

Eu seria ótimo se alguém pudesse apontar o que eu posso desabilitar. E como.

    
por Radek 01.04.2017 / 10:22

1 resposta

2

A desativação arbitrária de alguns desses serviços não tornará seu servidor da Web mais rápido ou mais seguro. Você poderia encontrar alguns que não são absolutamente obrigatórios? Certo. Você pode desabilitar o rsync e seu servidor não irá travar. Mas o seu servidor não é nem mais rápido nem seguro por causa disso. E, desabilitar o rsync tem consequências se / quando você decidir usar o rsync. Identificar serviços supérfluos certamente virá com uma longa lista de advertências.

Para segurança básica, pesquise na web artigos sobre como tornar seu servidor Linux compatível com PCI (e revise o padrão PCI DSS). Você encontrará grandes quantidades de artigos sobre como configurar elementos básicos de segurança: firewall local, parâmetros de senha do usuário, armazenamento de logs, etc. O padrão PCI não é o padrão dos padrões de segurança. Mas tem uma abordagem de senso comum para a segurança mínima que qualquer servidor da Web deve empregar.

Para obter desempenho básico, consulte documentos sobre o ajuste de desempenho do servidor da web que você planeja executar e como melhorar o desempenho do wordpress. Por exemplo (trivial), a otimização de gráficos em seu site pode melhorar significativamente o tempo de carregamento da página - mais do que qualquer desabilitação de serviço jamais poderia alcançar. Alguns scripts bash básicos, usando curl e data, ajudarão você a entender se suas alterações estão melhorando o desempenho. Mas, para realmente fazer a diferença no desempenho do servidor da Web, você terá que carregar dados de memória RAM, CPU, disco e rede durante os horários de pico.

    
por James 01.04.2017 / 15:10