Start, stop and configure services with systemd

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Examendoelen in dit hoofdstuk

Services starten en stoppen en ze bij het opstarten laten starten

Understand systemd and units

systemd manages units. A unit is one thing to manage, described in a small text file. The file name ends with the unit type.

Type	Example	Manages
`.service`	`sshd.service`	A program that runs (daemon)
`.socket`	`cockpit.socket`	A port or socket; starts the service on the first connection
`.mount`	`home.mount`	A mounted file system
`.target`	`multi-user.target`	A group of units (like a runlevel)
`.timer`	`fstrim.timer`	A time plan that starts a service
`.path`, `.slice`, `.device`, `.swap`		Other types

$systemctl -t help
$systemctl list-units -t service
$systemctl list-unit-files -t service

11.2

Find the unit files

Unit files live in three places. A file in /etc wins over the same name in /usr/lib.

Folder	Who writes it	Priority
`/usr/lib/systemd/system/`	Packages (do not edit)	Lowest
`/run/systemd/system/`	Created at run time	Middle
`/etc/systemd/system/`	You, the admin	Highest

$systemctl cat sshd.service
$systemctl show sshd.service -p FragmentPath,DropInPaths

Let op

Never edit files in /usr/lib/systemd/system/ — a package update overwrites them. Use systemctl edit (see below).

11.3

Read a service unit

A service unit has three sections: [Unit] (description and order), [Service] (how to run it) and [Install] (what enable does).

/usr/lib/systemd/system/sshd.service (short)

[Unit]
Description=OpenSSH server daemon
After=network.target sshd-keygen.target
Wants=sshd-keygen.target
 
[Service]
Type=notify
EnvironmentFile=-/etc/sysconfig/sshd
ExecStart=/usr/sbin/sshd -D $OPTIONS
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=42s
 
[Install]
WantedBy=multi-user.target

Line	Meaning
`ExecStart`	The command that starts the service
`Restart=on-failure`	Start it again when it crashes
`After=`	Start after these units (order only)
`Wants=` / `Requires=`	Also start these units (soft / hard dependency)
`WantedBy=multi-user.target`	`enable` links the service into this target

11.4

Know mount and socket units

systemd turns every line in /etc/fstab into a .mount unit. A .socket unit listens on a port and starts the service only when a client connects.

$systemctl list-units -t mount
$systemctl status home.mount
$systemctl cat cockpit.socket
$systemctl list-sockets

Notitie

The name of a mount unit is the path with - instead of /: /data/backup → data-backup.mount. systemd-escape -p /data/backup prints it.

11.5

Understand targets

A target is a group of units that brings the system into a state. They replace the old runlevels.

Target	State	Old runlevel
`graphical.target`	Multi-user with a desktop	5
`multi-user.target`	Multi-user, text only (servers)	3
`rescue.target`	Minimal system, single user, root login	1
`emergency.target`	Even less: root file system read-only	—

$systemctl get-default
$systemctl list-units -t target
$systemctl list-dependencies multi-user.target | head

Boot targets are covered in the boot chapter.

11.6

Start, stop and enable services

start/stop change the service now; enable/disable decide if it starts at boot. enable --now does both.

#systemctl start httpd
#systemctl stop httpd
#systemctl restart httpd
#systemctl reload httpd
#systemctl enable httpd
#systemctl enable --now httpd
#systemctl disable --now httpd

Command	Now	At boot
`start` / `stop`	yes	no
`enable` / `disable`	no	yes
`enable --now` / `disable --now`	yes	yes
`reload`	re-read the config without stopping	—

Examentip

Every service you set up on the exam must also run after a reboot. Always use systemctl enable --now SERVICE, and check with systemctl is-enabled SERVICE.

11.7

Check the state of a service

systemctl status shows if a service is loaded, enabled, active, its PID, cgroup and the last log lines.

$systemctl status sshd
● sshd.service - OpenSSH server daemon
     Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; preset: enabled)
     Active: active (running) since Sun 2026-10-25 07:58:30 CET; 2h 54min ago
   Main PID: 1010 (sshd)
$systemctl is-active sshd
$systemctl is-enabled sshd
$systemctl --failed

Word	Meaning
`loaded`	The unit file was read
`enabled` / `disabled`	Starts at boot / does not
`static`	Cannot be enabled itself; another unit starts it
`masked`	Blocked: cannot be started at all
`active (running)`	Runs now
`active (exited)`	Ran once and finished (OK for one-shot units)
`inactive (dead)`	Not running
`failed`	Crashed or could not start

11.8

Block a service with mask

mask links the unit to /dev/null, so nobody — not even a dependency — can start it. Use it for services that must never run together, or must never run.

#systemctl mask --now iptables
#systemctl start iptables
Failed to start iptables.service: Unit iptables.service is masked.
#systemctl unmask iptables

11.9

Understand dependencies

Units can need other units. Order (After, Before) and need (Wants, Requires) are separate settings.

Setting	Meaning
`Requires=B`	Start B too; if B fails or stops, stop me too
`Wants=B`	Start B too; I do not care if it fails
`Requisite=B`	B must already be running, or I fail
`Conflicts=B`	Never run together with B
`After=B` / `Before=B`	Only the order of start and stop

$systemctl list-dependencies httpd
$systemctl list-dependencies --reverse sshd

11.10

Change service settings safely

systemctl edit creates a drop-in file in /etc/systemd/system/NAME.service.d/override.conf. Only your changed lines go in it; the rest comes from the original file.

Open the override editor and add your settings.
```
#systemctl edit httpd
```
/etc/systemd/system/httpd.service.d/override.conf
```
[Service]
Restart=always
RestartSec=5s
MemoryMax=1G
```
systemctl edit reloads systemd for you. After editing files by hand, reload yourself and restart the service.
```
#systemctl daemon-reload
#systemctl restart httpd
```

Check the result.

$systemctl cat httpd
$systemctl show httpd -p Restart,MemoryMax

systemctl edit --full NAME copies the whole file to /etc/systemd/system/ (harder to update later).
systemctl revert NAME removes your changes.

Op het werk

Useful hardening lines for your own services: NoNewPrivileges=yes, ProtectSystem=strict, ProtectHome=yes, PrivateTmp=yes. systemd-analyze security NAME rates a service.

11.11

Write a simple service of your own

Any program or script can become a service with a small unit file in /etc/systemd/system/.

Create the unit file.

/etc/systemd/system/hello.service

[Unit]
Description=Hello demo service
After=network-online.target
 
[Service]
ExecStart=/usr/bin/bash -c 'while true; do echo "hello $(date)"; sleep 60; done'
Restart=on-failure
 
[Install]
WantedBy=multi-user.target

Load it, start it and enable it.

#systemctl daemon-reload
#systemctl enable --now hello

See its output in the journal.
```
#journalctl -u hello -f
```

11.12

Remember the main points

The most important facts of this chapter, in short.

systemd starts and watches everything as units: services, sockets, mounts, timers, targets and more.
Unit files live in /usr/lib/systemd/system (from packages) and /etc/systemd/system (your changes win).
systemctl start|stop|restart|reload NAME works now; enable|disable works at the next boot; enable --now does both.
systemctl status NAME shows state, the main PID and the last log lines.
mask makes a unit impossible to start; unmask undoes it.
Change a unit with systemctl edit NAME (a drop-in file); systemctl daemon-reload after you edit unit files by hand.
Dependencies: Wants= and Requires= say what else must run; After= and Before= set the order.
A target (like multi-user.target) is a group of units for a system state.

11.13

Learn the key terms

The words of this chapter in simple English.

Term	Meaning
systemd	The first process (PID 1); it starts and manages all units.
Unit	One thing systemd manages, like a service or a mount.
Unit file	The text file that describes a unit.
Service	A unit that runs a program (a daemon).
Socket unit	A unit that listens on a port and starts a service when needed.
Target	A group of units for one system state.
Enable	Start a unit automatically at boot.
Mask	Block a unit so nothing can start it.
Drop-in file	A small file that changes a part of a unit file.
Daemon	A program that runs in the background as a service.