Raspberry Pi4の不要なサービス・ハードの停止

Raspberry Pi4の不要なサービスの停止
Raspberry Pi4の不要なサービスの停止

WordPress専用のサーバとしてRaspberry Pi4を運営する上で、不要なサービス・ハードを停止して、サーバを軽くセキュリティ強度を上げます。

このページでは、Raspberry Pi OS Lite(64bit) bookworm 2023-10-10版で説明しています。

インストールされる内容は、バージョン毎に変わっていくので確認しながら停止してください。

インストール直後に起動しているサービスの確認

全サービスの起動状態を確認

下記のコマンドで確認します。

$ sudo systemctl list-units -t service
  UNIT                                                        LOAD   ACTIVE SUB     DESCRIPTION
  alsa-restore.service                                        loaded active exited  Save/Restore Sound Card State
  avahi-daemon.service                                        loaded active running Avahi mDNS/DNS-SD Stack
  bluetooth.service                                           loaded active running Bluetooth service
  console-setup.service                                       loaded active exited  Set console font and keymap
  cron.service                                                loaded active running Regular background program processing daemon
  dbus.service                                                loaded active running D-Bus System Message Bus
  dphys-swapfile.service                                      loaded active exited  dphys-swapfile - set up, mount/unmount, and delete a swap file
  fake-hwclock.service                                        loaded active exited  Restore / save the current clock
  getty@tty1.service                                          loaded active running Getty on tty1
  ifupdown-pre.service                                        loaded active exited  Helper to synchronize boot up for ifupdown
  keyboard-setup.service                                      loaded active exited  Set the console keyboard layout
  kmod-static-nodes.service                                   loaded active exited  Create List of Static Device Nodes
  ModemManager.service                                        loaded active running Modem Manager
  networking.service                                          loaded active exited  Raise network interfaces
  NetworkManager-wait-online.service                          loaded active exited  Network Manager Wait Online
  NetworkManager.service                                      loaded active running Network Manager
  polkit.service                                              loaded active running Authorization Manager
  raspi-config.service                                        loaded active exited  LSB: Switch to ondemand cpu governor (unless shift key is pressed)
  rc-local.service                                            loaded active exited  /etc/rc.local Compatibility
  rpc-statd-notify.service                                    loaded active exited  Notify NFS peers of a restart
  rpi-eeprom-update.service                                   loaded active exited  Check for Raspberry Pi EEPROM updates
  rsyslog.service                                             loaded active running System Logging Service
  ssh.service                                                 loaded active running OpenBSD Secure Shell server
  systemd-binfmt.service                                      loaded active exited  Set Up Additional Binary Formats
  systemd-fsck@dev-disk-by\x2dpartuuid-4c67ca80\x2d01.service loaded active exited  File System Check on /dev/disk/by-partuuid/4c67ca80-01
  systemd-journal-flush.service                               loaded active exited  Flush Journal to Persistent Storage
  systemd-journald.service                                    loaded active running Journal Service
  systemd-logind.service                                      loaded active running User Login Management
  systemd-modules-load.service                                loaded active exited  Load Kernel Modules
  systemd-random-seed.service                                 loaded active exited  Load/Save Random Seed
  systemd-remount-fs.service                                  loaded active exited  Remount Root and Kernel File Systems
  systemd-sysctl.service                                      loaded active exited  Apply Kernel Variables
  systemd-sysusers.service                                    loaded active exited  Create System Users
  systemd-timesyncd.service                                   loaded active running Network Time Synchronization
  systemd-tmpfiles-setup-dev.service                          loaded active exited  Create Static Device Nodes in /dev
  systemd-tmpfiles-setup.service                              loaded active exited  Create Volatile Files and Directories
  systemd-udev-trigger.service                                loaded active exited  Coldplug All udev Devices
  systemd-udevd.service                                       loaded active running Rule-based Manager for Device Events and Files
  systemd-update-utmp.service                                 loaded active exited  Record System Boot/Shutdown in UTMP
  systemd-user-sessions.service                               loaded active exited  Permit User Sessions
  triggerhappy.service                                        loaded active running triggerhappy global hotkey daemon
  user-runtime-dir@1000.service                               loaded active exited  User Runtime Directory /run/user/1000
  user@1000.service                                           loaded active running User Manager for UID 1000

LOAD   = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB    = The low-level unit activation state, values depend on unit type.
43 loaded units listed. Pass --all to see loaded but inactive units, too.
To show all installed unit files use 'systemctl list-unit-files'.

削除対象のサービスを下記に一覧表にしました。

  • mDNS/DNS
  • Sound
  • Bluetooth
  • WiFi
  • triggerhappy(キーボード ショートカット設定)
  • ModemManager
UNITSUBDESCRIPTION削除対象
alsa-restore.service                                        exited Save/Restore Sound Card State削除
avahi-daemon.service                                        runningAvahi mDNS/DNS-SD Stack削除
bluetooth.service                                           runningBluetooth service削除
bthelper@hci0.service                                       exited Raspberry Pi bluetooth helper削除
console-setup.service                                       exited Set console font and keymap 
cron.service                                                runningRegular background program processing daemon 
dbus.service                                                runningD-Bus System Message Bus 
dphys-swapfile.service                                      exited dphys-swapfile – set up, mount/unmount, and delete a swap file 
fake-hwclock.service                                        exited Restore / save the current clock 
getty@tty1.service                                          runningGetty on tty1 
ifupdown-pre.service                                        exited Helper to synchronize boot up for ifupdown 
keyboard-setup.service                                      exited Set the console keyboard layout 
kmod-static-nodes.service                                   exited Create List of Static Device Nodes 
ModemManager.service                                        runningModem Manager削除
networking.service                                          exited Raise network interfaces 
NetworkManager-wait-online.service                          exited Network Manager Wait Online 
NetworkManager.service                                      runningNetwork Manager 
polkit.service                                              runningAuthorization Manager 
raspi-config.service                                        exited LSB: Switch to ondemand cpu governor (unless shift key is pressed) 
rc-local.service                                            exited /etc/rc.local Compatibility 
rpc-statd-notify.service                                    exited Notify NFS peers of a restart 
rpi-eeprom-update.service                                   exited Check for Raspberry Pi EEPROM updates 
ssh.service                                                 runningOpenBSD Secure Shell server 
systemd-binfmt.service                                      exited Set Up Additional Binary Formats 
systemd-fsck@dev-disk-by\x2dpartuuid-fd8abcf3\x2d01.service exited File System Check on /dev/disk/by-partuuid/fd8abcf3-01 
systemd-journal-flush.service                               exited Flush Journal to Persistent Storage 
systemd-journald.service                                    runningJournal Service 
systemd-logind.service                                      runningUser Login Management 
systemd-modules-load.service                                exited Load Kernel Modules 
systemd-random-seed.service                                 exited Load/Save Random Seed 
systemd-remount-fs.service                                  exited Remount Root and Kernel File Systems 
systemd-sysctl.service                                      exited Apply Kernel Variables 
systemd-sysusers.service                                    exited Create System Users 
systemd-timesyncd.service                                   runningNetwork Time Synchronization 
systemd-tmpfiles-setup-dev.service                          exited Create Static Device Nodes in /dev 
systemd-tmpfiles-setup.service                              exited Create Volatile Files and Directories 
systemd-udev-trigger.service                                exited Coldplug All udev Devices 
systemd-udevd.service                                       runningRule-based Manager for Device Events and Files 
systemd-update-utmp.service                                 exited Record System Boot/Shutdown in UTMP 
systemd-user-sessions.service                               exited Permit User Sessions 
triggerhappy.service                                        runningtriggerhappy global hotkey daemon削除
user-runtime-dir@1000.service                               exited User Runtime Directory /run/user/1000 
user@1000.service                                           runningUser Manager for UID 1000 
wpa_supplicant.service                                      runningWPA supplicant削除

関係の無いサービスを無効化する

Raspberry Pi4を再起動してもサービスが始まらないよう無効にします。

サービスの停止

下記のコマンドでサービスを停止します。入力順も下記でお願いします。

$ sudo systemctl stop avahi-daemon.socket
$ sudo systemctl stop avahi-daemon.service
$ sudo systemctl stop bluetooth.service
$ sudo systemctl stop bthelper@hci0.service
$ sudo systemctl stop ModemManager.service
$ sudo systemctl stop hciuart.service
$ sudo systemctl stop triggerhappy.socket
$ sudo systemctl stop triggerhappy.service
$ sudo systemctl stop wpa_supplicant.service

サービスの非活性化

サーバの再起動でサービスが動き出さないよう非活性化します。

$ sudo systemctl disable avahi-daemon.socket
Removed "/etc/systemd/system/sockets.target.wants/avahi-daemon.socket".
$ sudo systemctl disable avahi-daemon.service
Removed "/etc/systemd/system/dbus-org.freedesktop.Avahi.service".
Removed "/etc/systemd/system/multi-user.target.wants/avahi-daemon.service".
$ sudo systemctl disable bluetooth.service
Synchronizing state of bluetooth.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install disable bluetooth
Removed /etc/systemd/system/dbus-org.bluez.service.
Removed /etc/systemd/system/bluetooth.target.wants/bluetooth.service.
$ sudo systemctl disable bthelper@hci0.service
$ sudo systemctl disable ModemManager.service
Removed /etc/systemd/system/dbus-org.freedesktop.ModemManager1.service.
Removed /etc/systemd/system/multi-user.target.wants/ModemManager.service.
$ sudo systemctl disable hciuart.service
Removed /etc/systemd/system/dev-serial1.device.wants/hciuart.service.
$ sudo systemctl disable triggerhappy.service
Synchronizing state of triggerhappy.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install disable triggerhappy
Removed /etc/systemd/system/multi-user.target.wants/triggerhappy.service.
$ sudo systemctl disable wpa_supplicant.service
Removed /etc/systemd/system/multi-user.target.wants/wpa_supplicant.service.
Removed /etc/systemd/system/dbus-fi.w1.wpa_supplicant1.service.

すっきりです。

ラズベリーパイの設定ファイルで使わないハードを非活性にする

Raspberry Pi4には、PCでいうところのBIOSにあたる/boot/firmware/config.txtがあります。

通常raspi-configのコマンドで変更します。

この章では直接viで変更します。

soundの非活性化の為モジュールを確認

下記のコマンドでロードされているモジュールを確認します。

$  cat /proc/asound/modules 
 0 snd_bcm2835
 1 vc4

上記2行は、dtparam=audio=onと、dtoverlay=vc4-kms-v3dおよひmax_framebuffers=2をコメントする事でロードを回避できます。

ハード、ドライバの無効化

下記のコマンドで編集します。

$ sudo vi /boot/firmware/config.txt

下記ファイルで、使わない所に#を入れて無効化しています。

# For more options and information see

# http://rptl.io/configtxt
# Some settings may impact device functionality. See link above for details

# Uncomment some or all of these to enable the optional hardware interfaces
#dtparam=i2c_arm=on
#dtparam=i2s=on
#dtparam=spi=on

# Enable audio (loads snd_bcm2835)
#dtparam=audio=on                    <==soundモジュールの停止の為コメント

# Additional overlays and parameters are documented
# /boot/firmware/overlays/README

# Automatically load overlays for detected cameras
#camera_auto_detect=1                <==CAMERAモジュールの停止の為コメント

# Automatically load overlays for detected DSI displays
display_auto_detect=1

# Automatically load initramfs files, if found
auto_initramfs=1

# Enable DRM VC4 V3D driver
#dtoverlay=vc4-kms-v3d               <==soundモジュールもロードされるのでコメント
#max_framebuffers=2                  <==上記非活性と併せてコメント

# Don't have the firmware create an initial video= setting in cmdline.txt.
# Use the kernel's default instead.
disable_fw_kms_setup=1

# Run in 64-bit mode
arm_64bit=1

# Disable compensation for displays with overscan
#disable_overscan=1                  <==液晶表示の為コメント

# Run as fast as firmware / board allows
arm_boost=1

[cm4]
# Enable host mode on the 2711 built-in XHCI USB controller.
# This line should be removed if the legacy DWC2 controller is required
# (e.g. for USB device mode) or if USB support is not required.
otg_mode=1

[all]
dtoverlay=disable-bt                 <==bluetooth非活性の為追加
dtoverlay=disable-wifi                 <==wifi非活性の為追加

終われば保存してください。

ここでreboot

$ sudo reboot

色々手を打った後のサービスの一覧です。

$ systemctl -t service
  UNIT                                                        LOAD   ACTIVE SUB     DESCRIPTION
  console-setup.service                                       loaded active exited  Set console font and keymap
  cron.service                                                loaded active running Regular background program processing daemon
  dbus.service                                                loaded active running D-Bus System Message Bus
  dphys-swapfile.service                                      loaded active exited  dphys-swapfile - set up, mount/unmount, and delete a swap file
  fake-hwclock.service                                        loaded active exited  Restore / save the current clock
  getty@tty1.service                                          loaded active running Getty on tty1
  ifupdown-pre.service                                        loaded active exited  Helper to synchronize boot up for ifupdown
  keyboard-setup.service                                      loaded active exited  Set the console keyboard layout
  kmod-static-nodes.service                                   loaded active exited  Create List of Static Device Nodes
  networking.service                                          loaded active exited  Raise network interfaces
  NetworkManager-wait-online.service                          loaded active exited  Network Manager Wait Online
  NetworkManager.service                                      loaded active running Network Manager
  raspi-config.service                                        loaded active exited  LSB: Switch to ondemand cpu governor (unless shift key is pressed)
  rc-local.service                                            loaded active exited  /etc/rc.local Compatibility
  rpc-statd-notify.service                                    loaded active exited  Notify NFS peers of a restart
  rpi-eeprom-update.service                                   loaded active exited  Check for Raspberry Pi EEPROM updates
  serial-getty@ttyAMA0.service                                loaded active running Serial Getty on ttyAMA0
  ssh.service                                                 loaded active running OpenBSD Secure Shell server
  systemd-binfmt.service                                      loaded active exited  Set Up Additional Binary Formats
  systemd-fsck@dev-disk-by\x2dpartuuid-68140be9\x2d01.service loaded active exited  File System Check on /dev/disk/by-partuuid/68140be9-01
  systemd-journal-flush.service                               loaded active exited  Flush Journal to Persistent Storage
  systemd-journald.service                                    loaded active running Journal Service
  systemd-logind.service                                      loaded active running User Login Management
  systemd-modules-load.service                                loaded active exited  Load Kernel Modules
  systemd-random-seed.service                                 loaded active exited  Load/Save Random Seed
  systemd-remount-fs.service                                  loaded active exited  Remount Root and Kernel File Systems
  systemd-sysctl.service                                      loaded active exited  Apply Kernel Variables
  systemd-sysusers.service                                    loaded active exited  Create System Users
  systemd-timesyncd.service                                   loaded active running Network Time Synchronization
  systemd-tmpfiles-setup-dev.service                          loaded active exited  Create Static Device Nodes in /dev
  systemd-tmpfiles-setup.service                              loaded active exited  Create Volatile Files and Directories
  systemd-udev-trigger.service                                loaded active exited  Coldplug All udev Devices
  systemd-udevd.service                                       loaded active running Rule-based Manager for Device Events and Files
  systemd-update-utmp.service                                 loaded active exited  Record System Boot/Shutdown in UTMP
  systemd-user-sessions.service                               loaded active exited  Permit User Sessions
  user-runtime-dir@1000.service                               loaded active exited  User Runtime Directory /run/user/1000
  user@1000.service                                           loaded active running User Manager for UID 1000

LOAD   = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB    = The low-level unit activation state, values depend on unit type.
38 loaded units listed. Pass --all to see loaded but inactive units, too.
To show all installed unit files use 'systemctl list-unit-files'.
systemctl list-unit-files'.

狙ったサービスは停止できました。

ご苦労様でした。

タイトルとURLをコピーしました