33

How can I disable all services except ssh on modern (systemd based) linux distributions?

I need to implement a maintenance mode.

All these services need to be down:

  • postgres
  • postfix
  • apache
  • cups
  • cron
  • dovecot

But ssh must not be shut down, since this gets used to do tasks during the maintenance mode.

Of course I could write a shell script which loops over a list of services which I would like to disable. But this feels like I reinventing something which already exists, but which I don't know up to now.

2
  • 1
    What type of tasks? Why do you need this?
    – ewwhite
    Commented Nov 25, 2017 at 13:30
  • @user430214 I updated the question. I added: Of course I could write a shell script which loops over a list of services which I would like to disable. But this feels like I reinventing something which already exists, but which I don't know up to now.
    – guettli
    Commented Nov 25, 2017 at 14:04

3 Answers 3

60

This sounds a lot like runlevels, replaced with targets in Systemd. So, instead of writing a script that starts and stop a list of services, you could create a new maintenance.target containing only the services necessary, like SSH. Of course, SSH is not quite useful without networking, so in this example a simple emergency-net.target is modified to include SSH.

[Unit]
Description=Maintenance Mode with Networking and SSH
Requires=maintenance.target systemd-networkd.service sshd.service
After=maintenance.target systemd-networkd.service sshd.service
AllowIsolate=yes

Then, you could enter your maintenance mode using

# systemctl isolate maintenance.target

and back

# systemctl isolate multi-user.target
4
  • 2
    Thank you very much for this answer. It shows me that asking is useful, even if you think there is no nice answer except writing a dirty shell script. The emergency-net.target is a simple and elegant solution - great :-)
    – guettli
    Commented Nov 27, 2017 at 11:40
  • It certainly is, as it also takes care of all the dependencies, and you don't need to update your script every time you install a new service. Commented Nov 27, 2017 at 11:41
  • 1
    Could you please post what the maintenance.target file looks like? The above isn't working for me and I wonder if it's something I'm getting wrong in maintenance.target. Commented Apr 14, 2020 at 18:51
  • @chilicheech: Sorry for the late reply. You can take any suitable .target from /lib/systemd/system and modify your desired maintenance.target from that. It seems e.g. Debian 10 doesn't have the emergency-net.target used here anymore. Commented Jul 24, 2020 at 8:42
5

Based on the excellent answer of @Esa, on Debian 10, you have the file rescue-ssh.target to disable all services, except ssh and networking:

/lib/systemd/system/rescue-ssh.target

[Unit]
Description=Rescue with network and ssh
Documentation=man:systemd.special(7)
Requires=network-online.target ssh.service
After=network-online.target ssh.service
AllowIsolate=yes

So now, you can proceed as fallows:

1. Enter in the maintenance mode:

systemctl isolate rescue-ssh.target (only ssh and networking)

2. Check the maintenance mode:

lsof -i:1-65535 (and you will only see the port of the ssh running)

3. Exit from the maintenance mode:

systemctl isolate multi-user.target (and everything is back again)

1
  • This worked perfectly for me on Ubuntu 18.04.1 LTS, thanks. I'm having trouble getting it to work on CentOS 7. I realise that the file should be placed in /usr/lib/systemd/system/rescue-ssh.target and should use sshd instead of ssh. Am I missing anything else? Commented Oct 12, 2022 at 11:08
3

First list your services and search for their corresponding systemd-names.

Then build a list and stop each list member to enter maintenance, start each member after maintenance.

2
  • 6
    Why not just use systemctl isolate?
    – Chris Down
    Commented Nov 25, 2017 at 22:41
  • @ChrisDown I posted an answer about that.
    – robe007
    Commented Mar 18, 2021 at 22:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .