2.4 Ensure nonessential services are removed or masked


A network port is identified by its number, the associated IP address, and the type of the communication protocol such as TCP or UDP.

A listening port is a network port on which an application or process listens on, acting as a communication endpoint.

Each listening port can be open or closed (filtered) using a firewall. In general terms, an open port is a network port that accepts incoming packets from remote locations.


Services listening on the system pose a potential risk as an attack vector. These services should be reviewed, and if not required, the service should be stopped, and the package containing the service should be removed. If required packages have a dependency, the service should be stopped and masked to reduce the attack surface of the system.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.


Run the following command to remove the package containing the service:

# yum remove <package_name>

OR If required packages have a dependency:
Run the following command to stop and mask the service:

# systemctl --now mask <service_name>

See Also


Item Details


References: 800-53|SI-4, CSCv7|9.2

Plugin: Unix

Control ID: 928deabe8de99b56abe3e07362e2ebf45df8dfb55da5a928338824935ef8de75