Only approved services listen on network interfaces

Description

Each TCP or UDP socket listening on a non-loopback address must belong to a service the system is meant to provide, and listen only on the interfaces where that service is needed.

The check lists the listening sockets outside loopback as protocol/port process and always passes, so the control ends as review: a person must compare the list with the services approved for the system role. On a fresh Ubuntu cloud image the list holds the SSH server (tcp/22, shown as systemd from 24.04 because ssh.socket listens for it) and the DHCP client of systemd-networkd (udp/68). systemd-resolved and chronyd listen on loopback only.

Rationale

The services an attacker can reach from the network define the remote attack surface. Services that listen by default (LLMNR in systemd-resolved, development servers, agents) are easy to forget and widen it without anyone noticing.

Impact

Stopping or rebinding a service makes it unreachable for remote clients; check with its owner first.

Audit

1. Run ss -Hltunp as root.
2. For each socket not bound to 127.0.0.0/8 or ::1, check that the process is an approved service for this system and that it listens only on the needed addresses.

Automated: every check must pass. Scanners report each check by its id.

listeners

Lists sockets listening outside loopback, for review.

script: |
  command -v ss >/dev/null 2>&1 || { echo "ss not found"; exit 3; }
  ss -Hltunp 2>/dev/null | awk '{
    addr = $5
    if (addr ~ /^(127\.|\[::1\]|\[::ffff:127\.)/) next
    port = addr; sub(/.*:/, "", port)
    proc = $7; sub(/^users:\(\("/, "", proc); sub(/".*/, "", proc)
    print $1 "/" port " " (proc == "" ? "?" : proc)
  }' | sort -u | tr '\n' ' '
  echo

Remediation

For each socket that is not approved: stop and mask the service (systemctl mask --now <unit>) or remove its package. For an approved service that listens too widely, bind it to the needed address in its configuration, and filter the port with the host firewall.

References

• ss(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R80) ANSSI, guide, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle