A disabled .service unit is not proof that its network endpoint is absent. A .socket unit can bind a local or network socket and start a matching service when traffic arrives, so exposure audits should inventory socket units as well as services.
How does socket activation work?
A systemd socket unit describes an IPC, FIFO, or network socket. systemd opens and supervises it, then passes the socket to a matching service when a connection arrives. The service may therefore be idle while the listening boundary remains active.
The default relationship is name-based: example.socket commonly activates example.service, unless Service= changes it. Check the unit files rather than relying on assumptions.
What should an audit include?
- Socket units enabled or active at boot.
- Bind addresses and ports declared by those units.
- The service activated by each socket.
- Host firewall and provider firewall policy.
- Whether the service has authentication and authorization appropriate to its audience.
A local listener is not automatically internet-reachable, and a public bind is not by itself proof that upstream routing permits access. Treat the socket as one layer in the exposure chain.
Why does this matter?
Service inventories that only list running processes can miss on-demand activation. Add socket units to the same review as ss output, firewall rules, DNS, and reverse-proxy configuration.
For operator context, see systemd for small server operators and checking listening ports.