Determine you exposure

Taking your output from the netstat command, what looks like a lot of services is actually a very short list:

$ netstat -lntup | awk '{print $6 $7}'|sed 's/LISTEN//'| cut -d"/" -f2|sort|uniq|grep -v Foreign
avahi-daemon:r
dhclient
dropbox
nmbd
rpcbind
rpc.statd
smbd
sshd

Getting a lay of the land

Looking at this list there are several services which I'd leave alone.

• dhclient
  • DHCP server daemon responsible for getting your IP address, have to have this one.
• dropbox
  • obviously Dropbox, have to have

Start reducing it - disable Samba

You can probably right off the bat disable Samba, it accounts for 2 of the above services, nmbd andsmbd. It's questionable that you'd really need that running on a laptop whether on localhost or your IP facing your network.

To check that they're running you can use the following command, status:

$ status nmbd
nmbd start/running, process 19457
$ status smbd
smbd start/running, process 19423

Turning services off can be confusing with all the flux that's been going on with upstart, /etc/rc.d, business so it might be difficult to figure out which service is under which technology. For Samba you can use the service command:

$ sudo service nmbd stop
nmbd stop/waiting
$ sudo service smbd stop
smbd stop/waiting

Now they're off:

$ status nmbd 
nmbd stop/waiting
$ status smbd 
smbd stop/waiting

Keeping them off ... permanently

To make them stay off I've been using this tool, sysv-rc-conf, to manage services from a console, it works better than most. It allows you to check which services you want to run and in which runlevel they should be started/stopped:

$ sudo apt-get install sysv-rc-conf

Disabling the rest of what's NOT needed

So now Samba's off we're left with the following:

• avahi-daemon
  • part of zeroconf (plug-n-play), turn it off
• rpcbind
  • needed for NFS - turn it off
• rpc.statd
  • needed for NFS - turn it off

For the remaining 3 you can do the same things we did for Samba to turn them off as well.

CUPS?

To turn CUPS off, which you don't really need by the way, you can follow the same dance of turning the service off and then disabling it from starting up. To be able to print you'll need to setup each printer individually on your system. You can do so through the system-config-printer GUI.

Making these services on demand?

This is really the heart of your question but there isn't really a silver bullet solution to making these services "smart" so that they run when they're being used, rather than all the time.

Part of it is the current split between systemd and upstart. There's a good overview of the 2 competing technologies here.

Both technologies are trying to do slightly different things, IMO, given their feature sets, systemd seems geared more towards servers whereas upstart seems geared more towards the desktop roll. Over time this will work itself out, IMO, and both services will be stable and feature rich.

Eventually both services will offer on demand starting & stopping across the board for all the services they manage. Features such as StopWhenUnneeded=yes already exist in systemd for example, so it's only a matter of time until these capabilities get fleshed out.

Some services don't support being stopped/started very well if at all. Services such as sshd seem to make little sense to run as on-demand, especially if they're used heavily. Also some services such as Apache provide mechanisms within themselves to spin up more or less of their own listeners managing themselves. So it's unclear how on-demand provided by systemd or upstart are going to integrate with these types of services.

• starting sshd on first connection to port 22 with upstart's new socket bridge
• CUPS and systemd: on demand start and stop

Is this really necessary?

You'll hear from both sides that this is overkill or that you should take a minimalist's approach only installing what you absolutely need, but it's really a personal choice. Understanding that these services are there and what they do is really what's important. At the end of the day a computer is a tool, and by using a Unix system you're already saying that you're willing to peek behind the curtain and understand what makes your computer tick.

I'd say that this type of questioning is exactly the frame of mind one should strive for when dealing with computers and Unix in general.

References

• Recommended way to enable & disable services
• upstart - wikipedia
• systemd - wikipedia