15.2 Start, Stop, and Enable Services at Boot

15.2 Start, Stop, and Enable Services at Boot

Quick Answer: Start or stop now with systemctl start|stop|restart UNIT. Make a service survive reboot with systemctl enable UNIT. Do both in one step: systemctl enable --now UNIT. Confirm with systemctl is-active, is-enabled, and status. Reboot when the task requires proof of persistence.

Scope: deploy vs operate

Chapter 10 practiced runtime control of network services (start/stop/status). This deploy objective stresses persistent enablement at boot as well as everyday start/stop—exactly what graders check after reboot on EX200.

Typical task language:

• “Install and enable httpd so it starts on boot.”
• “Ensure firewalld is running and enabled.”
• “Disable service X from starting at boot but leave the package installed.”
• “Stop and disable Y.”

You must leave the machine correct after reboot, not only in the current session.

Core systemctl verbs

sudo systemctl start httpd
sudo systemctl stop httpd
sudo systemctl restart httpd
sudo systemctl reload httpd
systemctl status httpd -l --no-pager
systemctl is-active httpd
systemctl is-enabled httpd

Enablement: what “at boot” means

Enabled means systemd has install-section symlinks (usually under /etc/systemd/system/*.wants/) so that when the default target (and dependency tree) starts, the unit is pulled in.

sudo systemctl enable httpd
# often creates:
# /etc/systemd/system/multi-user.target.wants/httpd.service -> /usr/lib/systemd/system/httpd.service

systemctl is-enabled httpd
ls -l /etc/systemd/system/multi-user.target.wants/httpd.service
systemctl disable httpd

Enabled ≠ active. You can enable without starting:

sudo systemctl enable httpd
systemctl is-enabled httpd    # enabled
systemctl is-active httpd     # inactive until start or reboot

Or start without enable (dies across reboot):

sudo systemctl start httpd
systemctl is-active httpd     # active
systemctl is-enabled httpd    # disabled

EX200 almost always wants both when it says the service should be available after reboot and usable now:

sudo systemctl enable --now httpd
systemctl is-enabled httpd
systemctl is-active httpd

enable --now and disable --now

sudo systemctl enable --now firewalld
sudo systemctl disable --now postfix    # example: stop now and do not start at boot

Reading status like a grader

systemctl status sshd -l --no-pager

Inspect:

1. Loaded: path to unit; enabled / disabled / static / indirect / masked.
2. Active: active (running), inactive (dead), failed, activating.
3. Docs / Main PID and trailing journal lines.

systemctl is-active sshd; echo exit:$?
systemctl is-enabled sshd; echo exit:$?
systemctl --failed

For static units, enabling the “real” service the package documents (or enabling a target that pulls them) is the path—do not invent a fake [Install] unless the task asks for a custom unit.

mask vs disable

sudo systemctl disable cups
sudo systemctl mask cups
systemctl is-enabled cups    # masked
sudo systemctl start cups    # fails while masked
sudo systemctl unmask cups
sudo systemctl enable --now cups   # if you need it again

• disable: do not start at boot; manual start still works.
• mask: cannot start until unmask—strongest off switch.

Only mask when the task requires that the service cannot be started, or when resolving a conflict that demands it. Accidental mask of NetworkManager or sshd is an exam disaster.

Custom units and drop-ins

Admin units:

sudo vim /etc/systemd/system/myapp.service
sudo systemctl daemon-reload
sudo systemctl enable --now myapp.service

Override vendor unit without editing /usr/lib:

sudo systemctl edit httpd
# creates /etc/systemd/system/httpd.service.d/override.conf
sudo systemctl daemon-reload
sudo systemctl restart httpd

systemctl cat httpd
systemctl show httpd -p WantedBy -p FragmentPath

Always daemon-reload after changing unit files on disk before relying on enable/start.

Service vs socket vs timer (naming)

systemctl list-unit-files --type=service | head
systemctl list-units --type=service --state=running

Some software is socket-activated (foo.socket starts foo.service on demand). If a task says enable the service, follow the unit name it gives. Enabling *.timer was Section 15.1; same enable/--now rules apply.

systemctl list-dependencies multi-user.target | head

Safe patterns for important units

sshd — do not lock yourself out

sudo sshd -t && sudo systemctl reload sshd
systemctl is-enabled sshd
systemctl is-active sshd

Prefer reload after config test. Keep sshd enabled on remote exam hosts unless told otherwise.

firewalld

sudo systemctl enable --now firewalld
systemctl is-active firewalld
firewall-cmd --state

httpd / nginx style application services

sudo dnf install -y httpd
sudo systemctl enable --now httpd
systemctl is-enabled httpd
systemctl is-active httpd
# open firewall ports in the security/networking tasks as required

“Stop and disable”

sudo systemctl disable --now bluetooth
systemctl is-enabled bluetooth
systemctl is-active bluetooth

Full verification including reboot

sudo systemctl enable --now httpd
systemctl is-enabled httpd
systemctl is-active httpd
sudo systemctl reboot
# after login:
systemctl is-enabled httpd
systemctl is-active httpd
systemctl --failed

If enabled but inactive after boot, the unit failed—use status and journalctl -u httpd -b (Ch10 skills) and fix config, then re-enable/start as needed.

Enabling targets vs services

You can enable targets, but day-to-day EX200 “enable the service” means something.service. Changing the default boot target is Section 15.3 (set-default). Do not confuse:

systemctl enable httpd.service
systemctl set-default multi-user.target

Examining [Install] and WantedBy

systemctl cat httpd | sed -n '/\[Install\]/,+5p'

Typical:

[Install]
WantedBy=multi-user.target

enable creates a symlink from multi-user.target.wants/. If [Install] is missing, enable may say the unit is static or cannot be enabled—start it via a dependency or add a proper [Install] only for units you own.

Exam workflows

Workflow A — Package install + persistent service

sudo dnf install -y httpd
sudo systemctl enable --now httpd
systemctl is-enabled httpd && systemctl is-active httpd

Workflow B — Ensure enabled but restart cleanly after config edit

sudo vim /etc/httpd/conf/httpd.conf
sudo apachectl configtest 2>/dev/null || sudo httpd -t
sudo systemctl restart httpd
systemctl is-active httpd
systemctl is-enabled httpd   # still enabled

Workflow C — Remove from boot and stop now

sudo systemctl disable --now httpd
systemctl is-enabled httpd   # disabled
systemctl is-active httpd    # inactive

Workflow D — Recover a masked unit

systemctl is-enabled httpd
sudo systemctl unmask httpd
sudo systemctl enable --now httpd

Workflow E — Failed after enable

sudo systemctl enable --now httpd
systemctl is-active httpd || {
  systemctl status httpd -l --no-pager
  sudo journalctl -u httpd -b -p err --no-pager
}

Common traps

1. start without enable — works until reboot; fails EX200 persistence.
2. enable without start or --now — not running until reboot (or manual start).
3. Checking only status green flash without is-enabled.
4. mask when disable was enough—or leaving a critical unit masked.
5. Editing /usr/lib/systemd/system units instead of drop-ins under /etc.
6. Forgetting daemon-reload after writing a new unit.
7. Wrong unit name (httpd vs apache2—on RHEL it is httpd).
8. Assuming failed unit is disabled—it may be enabled and failed; fix the failure.
9. Stopping NetworkManager/sshd casually on a remote VM.
10. Confusing systemctl restart UNIT with systemctl reboot.

Relationship to other objectives

• Ch10 network services: same verbs; here emphasize enable at boot and deploy persistence.
• 15.1 timers: enable --now name.timer is the same enablement model.
• 15.3 default target: which target graph runs; enabled services for multi-user still need that target (or a dependent one) to be reached.
• Networking boot (later): network services enabled so addresses and firewall policy exist after reboot.
• Software management: install packages before enable—missing unit files mean enable fails.

Section checkpoint

You should start and stop services with systemctl, distinguish active from enabled, use enable --now / disable --now, inspect status and --failed, use mask/unmask only when appropriate, daemon-reload after unit edits, and verify both runtime and boot persistence—ideally with a reboot check. That meets the EX200 deploy skill for services at boot on RHEL 10.