34 - Masking Services

Concept

While simply disabling a service, a disabled service can still be started manually by:
- Administrator
- Triggered as a dependency by another service.
Masking links a unit to the /dev/null device, which ensures that it cannot be started.

Tutorial

In this tutorial, httpd service is used as example

service is one of the unit types (Refer 32.2 Monitoring --> 2.)

Install unit

Verify httpd installed or not
- systemctl | grep "[Service Name]"
- If the service hasn't installed, terminal will return nothing.
- Example: systemctl | grep "httpd"
Install the unit
- dnf install -y [Service Name]
- Example: dnf install -y httpd
View the content of unit file
- systemctl cat [Service Name].service
- If the service hasn't installed, terminal will return No file found for [Service Name].service.
- Press q to exit
- Example: systemctl cat httpd.service

Masking

Start the service
- systemctl start [Service Name]
- Example: systemctl start httpd
Check service status
- Press q to quit
- systemctl status [Service Name]
- Example: systemctl status httpd
Stop the service
- systemctl stop [Service Name]
- Example: systemctl stop httpd
Check service status
- Press q to quit
- systemctl status [Service Name]
- Example: systemctl status httpd
Mask the service
- systemctl mask [Service Name]
- Example: systemctl mask httpd
Check service status
- Press q to quit
- systemctl status [Service Name]
- Example: systemctl status httpd
Start the service
- Terminal will return error: Failed to start [Service Name].service: Unit [Service Name].service is masked.
- systemctl start [Service Name]
- Example:

systemctl start httpd

Failed to start httpd.service: Unit httpd.service is masked.

Unmask the service
- systemctl unmask [Service Name]
- Example: systemctl unmask httpd
Check service status
- Press q to quit
- systemctl status [Service Name]
- Example: systemctl status httpd
Start the service
- systemctl start [Service Name]
- Example: systemctl start httpd
Check service status
- Press q to quit
- systemctl status [Service Name]
- Example: systemctl status httpd

Cleanup

Stop the service
- sudo systemctl stop [Service Name].service
- Example: sudo systemctl stop httpd.service
Disable the service
- sudo systemctl disable [Service Name].service
- Example: sudo systemctl disable httpd.service
Remove the custom override directory
- sudo rm -rf /etc/systemd/system/[Service Name].service.d
- Example: sudo rm -rf /etc/systemd/system/httpd.service.d
Uninstall the apache package
- sudo dnf remove -y [Service Name]
- Example: sudo dnf remove -y httpd
Reload systemd manager configuration
- sudo systemctl daemon-reload
Verify
- systemctl cat [Service Name].service
- If the service hasn't installed, terminal will return No file found for [Service Name].service.
- Press q to exit
- Example: systemctl cat httpd.service

Result

Install unit

student@localhost:~$ systemctl | grep "httpd"

student@localhost:~$ sudo dnf install -y httpd

[sudo] password for student:

Updating Subscription Management repositories.

Last metadata expiration check: 1:33:24 ago on Wed 19 Aug 2026 10:24:39 AM +08.

Dependencies resolved.

=============================================================================================================================================================

Package Architecture Version Repository Size

=============================================================================================================================================================

Installing:

httpd x86_64 2.4.63-13.el10_2.5 rhel-10-for-x86_64-appstream-rpms 56 k

Installing dependencies:

apr x86_64 1.7.5-3.el10 rhel-10-for-x86_64-appstream-rpms 127 k

apr-util x86_64 1.6.3-23.el10_1 rhel-10-for-x86_64-appstream-rpms 103 k

apr-util-lmdb x86_64 1.6.3-23.el10_1 rhel-10-for-x86_64-appstream-rpms 20 k

httpd-core x86_64 2.4.63-13.el10_2.5 rhel-10-for-x86_64-appstream-rpms 1.5 M

httpd-filesystem noarch 2.4.63-13.el10_2.5 rhel-10-for-x86_64-appstream-rpms 20 k

httpd-tools x86_64 2.4.63-13.el10_2.5 rhel-10-for-x86_64-appstream-rpms 90 k

redhat-logos-httpd noarch 100.3-2.el10 rhel-10-for-x86_64-appstream-rpms 22 k

Installing weak dependencies:

apr-util-openssl x86_64 1.6.3-23.el10_1 rhel-10-for-x86_64-appstream-rpms 22 k

mod_http2 x86_64 2.0.29-4.el10_2.2 rhel-10-for-x86_64-appstream-rpms 171 k

mod_lua x86_64 2.4.63-13.el10_2.5 rhel-10-for-x86_64-appstream-rpms 66 k

Transaction Summary

=============================================================================================================================================================

Install 11 Packages

Total download size: 2.2 M

Installed size: 6.0 M

Downloading Packages:

(1/11): apr-util-lmdb-1.6.3-23.el10_1.x86_64.rpm 8.4 kB/s | 20 kB 00:02

(2/11): apr-util-openssl-1.6.3-23.el10_1.x86_64.rpm 8.8 kB/s | 22 kB 00:02

(3/11): redhat-logos-httpd-100.3-2.el10.noarch.rpm 28 kB/s | 22 kB 00:00

(4/11): apr-util-1.6.3-23.el10_1.x86_64.rpm 31 kB/s | 103 kB 00:03

(5/11): apr-1.7.5-3.el10.x86_64.rpm 107 kB/s | 127 kB 00:01

(6/11): httpd-2.4.63-13.el10_2.5.x86_64.rpm 115 kB/s | 56 kB 00:00

(7/11): httpd-filesystem-2.4.63-13.el10_2.5.noarch.rpm 39 kB/s | 20 kB 00:00

(8/11): mod_http2-2.0.29-4.el10_2.2.x86_64.rpm 122 kB/s | 171 kB 00:01

(9/11): httpd-tools-2.4.63-13.el10_2.5.x86_64.rpm 60 kB/s | 90 kB 00:01

(10/11): mod_lua-2.4.63-13.el10_2.5.x86_64.rpm 50 kB/s | 66 kB 00:01

(11/11): httpd-core-2.4.63-13.el10_2.5.x86_64.rpm 120 kB/s | 1.5 MB 00:12

-------------------------------------------------------------------------------------------------------------------------------------------------------------

Total 135 kB/s | 2.2 MB 00:16

Running transaction check

Transaction check succeeded.

Running transaction test

Transaction test succeeded.

Running transaction

Preparing : 1/1

Installing : apr-1.7.5-3.el10.x86_64 1/11

Installing : apr-util-lmdb-1.6.3-23.el10_1.x86_64 2/11

Installing : apr-util-openssl-1.6.3-23.el10_1.x86_64 3/11

Installing : apr-util-1.6.3-23.el10_1.x86_64 4/11

Installing : httpd-tools-2.4.63-13.el10_2.5.x86_64 5/11

Running scriptlet: httpd-filesystem-2.4.63-13.el10_2.5.noarch 6/11

Installing : httpd-filesystem-2.4.63-13.el10_2.5.noarch 6/11

Installing : httpd-core-2.4.63-13.el10_2.5.x86_64 7/11

Installing : mod_http2-2.0.29-4.el10_2.2.x86_64 8/11

Installing : mod_lua-2.4.63-13.el10_2.5.x86_64 9/11

Installing : redhat-logos-httpd-100.3-2.el10.noarch 10/11

Installing : httpd-2.4.63-13.el10_2.5.x86_64 11/11

Running scriptlet: httpd-2.4.63-13.el10_2.5.x86_64 11/11

Installed products updated.

Installed:

apr-1.7.5-3.el10.x86_64 apr-util-1.6.3-23.el10_1.x86_64 apr-util-lmdb-1.6.3-23.el10_1.x86_64 apr-util-openssl-1.6.3-23.el10_1.x86_64

httpd-2.4.63-13.el10_2.5.x86_64 httpd-core-2.4.63-13.el10_2.5.x86_64 httpd-filesystem-2.4.63-13.el10_2.5.noarch httpd-tools-2.4.63-13.el10_2.5.x86_64

mod_http2-2.0.29-4.el10_2.2.x86_64 mod_lua-2.4.63-13.el10_2.5.x86_64 redhat-logos-httpd-100.3-2.el10.noarch

Complete!

Masking

student@localhost:~$ sudo systemctl start httpd

student@localhost:~$ sudo systemctl status httpd

● httpd.service - The Apache HTTP Server

Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; preset: disabled)

Active: active (running) since Wed 2026-08-19 14:50:48 +08; 1min 54s ago

Invocation: 6a63bee221a94df4b3669040a4b61c6b

Docs: man:httpd.service(8)

Main PID: 7804 (httpd)

Status: "Total requests: 0; Idle/Busy workers 100/0;Requests/sec: 0; Bytes served/sec: 0 B/sec"

Tasks: 177 (limit: 22995)

Memory: 13.5M (peak: 13.8M)

CPU: 410ms

CGroup: /system.slice/httpd.service

├─7804 /usr/sbin/httpd -DFOREGROUND

├─7805 /usr/sbin/httpd -DFOREGROUND

├─7806 /usr/sbin/httpd -DFOREGROUND

├─7807 /usr/sbin/httpd -DFOREGROUND

└─7808 /usr/sbin/httpd -DFOREGROUND

Aug 19 14:50:48 localhost.localdomain systemd[1]: Starting httpd.service - The Apache HTTP Server...

Aug 19 14:50:48 localhost.localdomain (httpd)[7804]: httpd.service: Referenced but unset environment variable evaluates to an empty string: OPTIONS

Aug 19 14:50:48 localhost.localdomain httpd[7804]: AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using localhost.lo>

Aug 19 14:50:48 localhost.localdomain httpd[7804]: Server configured, listening on: port 80

Aug 19 14:50:48 localhost.localdomain systemd[1]: Started httpd.service - The Apache HTTP Server.

student@localhost:~$ sudo systemctl stop httpd

student@localhost:~$ sudo systemctl status httpd

○ httpd.service - The Apache HTTP Server

Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; preset: disabled)

Active: inactive (dead)

Docs: man:httpd.service(8)

Aug 19 14:50:48 localhost.localdomain systemd[1]: Starting httpd.service - The Apache HTTP Server...

Aug 19 14:50:48 localhost.localdomain (httpd)[7804]: httpd.service: Referenced but unset environment variable evaluates to an empty string: OPTIONS

Aug 19 14:50:48 localhost.localdomain httpd[7804]: AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using localhost.lo>

Aug 19 14:50:48 localhost.localdomain httpd[7804]: Server configured, listening on: port 80

Aug 19 14:50:48 localhost.localdomain systemd[1]: Started httpd.service - The Apache HTTP Server.

Aug 19 14:54:38 localhost.localdomain systemd[1]: Stopping httpd.service - The Apache HTTP Server...

Aug 19 14:54:39 localhost.localdomain systemd[1]: httpd.service: Deactivated successfully.

Aug 19 14:54:39 localhost.localdomain systemd[1]: Stopped httpd.service - The Apache HTTP Server.

student@localhost:~$ sudo systemctl mask httpd

Created symlink '/etc/systemd/system/httpd.service' → '/dev/null'.

student@localhost:~$ sudo systemctl status httpd

○ httpd.service

Loaded: masked (Reason: Unit httpd.service is masked.)