CIS: Service Minimization

Every running service is attack surface. This host was imaged with special-purpose daemons it doesn't need — mDNS discovery (avahi), a print server (CUPS), and the RPC portmapper (rpcbind) — plus a mail transfer agent listening on every interface. Per CIS Benchmark §2, minimize services.

The CIS-recommended way to guarantee a service can never start is to MASK it, which on disk is a symlink from the unit name to /dev/null:

systemctl mask avahi-daemon # if systemd is the init

# or, equivalently, the on-disk effect it creates:

ln -sf /dev/null /etc/systemd/system/avahi-daemon.service

In this container systemd isn't PID 1 (sshd is), so systemctl mask may not reach a bus — use the ln form; grading reads the resulting symlink exactly as a CIS-CAT scan would. For the MTA, CIS doesn't remove it — mail still needs to flow locally — it just confines it: set inet_interfaces to loopback-only in /etc/postfix/main.cf.

Mask the three unneeded services and confine the MTA.