Which Daemons Still Dial Out After You Decline?
Which services on a current Linux install still open an outbound socket after the desktop opt-out is declined? A named egress drop outlasts an installer checkbox; mask the reporter units and drop only their destinations; leave mirror, NTP, and keyserver paths alone; re-check after a major upgrade because unit names and hostnames move.
This baseline holds for stock desktop and server images you actually installed. Any later Flatpak, Snap, or third-party vendor agent sits outside that first pass until you inventory its sandbox egress paths the exact same way.
To separate actual background senders from benign system daemons, record outbound SYN packets and DNS queries on a clean workstation installation after declining the welcome-screen telemetry prompts and before applying host-level unit masks. An unconfigured workstation can generate non-mirror outbound connection attempts even when desktop privacy toggles are set to off. Background reporting timers may schedule their initial firing after graphical target initialization, or via a systemd timer with Persistent=true and a randomized delay.
Why systemd-analyze Is the Wrong Process to Block
Community hardening scripts frequently bundle systemd-analyze into telemetry removal lists. Treat that grouping as a testable hypothesis rather than established fact: the binary functions strictly as a local diagnostic tool for boot timing, unit state, and security posture, and it never initializes a metrics socket of its own.
Binary linkage inspection and strace runs during blame, security, and plot execution can show how it handles system state. Use strace -e trace=network systemd-analyze security to check for AF_INET or AF_INET6 socket calls. The binary communicates over /run/systemd/private and local D-Bus UNIX domain sockets, reading local unit state and configuration from paths such as /lib/systemd/system, /etc/systemd/system, and /run.
You can verify these local boundaries directly in the systemd-analyze manual and by inspecting the unit files on your own machine. Our conclusions here apply strictly to default units shipped by the distribution, rechecked on the specific release in front of you, rather than every downstream spin or custom image rebuild.
Install Reporters, Crash Uploaders, and Desktop Feedback
Rather than maintaining a brittle master list of distribution-specific IP addresses across distribution reviews, sort outbound collectors by their operational job on the system. Extracting target endpoints directly from /usr/lib/systemd/system/*.timer files, /etc/cron.daily/ scripts, and daemon configuration files on the live filesystem breaks these background senders into four functional categories:
- Install and hardware inventory reporters: Tools such as ubuntu-report that gather initial partition, OEM, and hardware profile data.
- Crash uploaders: Daemons like whoopsie and abrt-cli (part of the abrt suite) that monitor crash directories. When an unhandled binary crash occurs, systemd-coredump or apport writes a core file ranging from 4 MB to over 250 MB before the uploader daemon attempts an HTTPS POST over port 443.
- Popularity counters: Scheduled utilities such as popularity-contest that catalog installed package formats and access times.
- Desktop feedback agents: User-space helpers integrated into desktop environments that prompt for or quietly submit session metrics.
Packages like popularity-contest, whoopsie, abrt-cli, and ubuntu-report trigger on fixed schedules—commonly a 24-hour cron window or a 7-day OnCalendar=weekly timer—or watch /var/crash via inotify or systemd .path units. Inventory your own system using your package manager and systemctl, then confirm any target destination exclusively from that package's unit file, sysusers.d snippet, or upstream documentation. Hostnames extracted from unit files on one distribution release do not form a permanent blocklist; a subsequent 6-month feature release or point upgrade can introduce a new collector binary or endpoint that older firewall rules never referenced.
Egress Rules That Drop Reporters and Spare Mirrors
Blocking telemetry via /etc/hosts or local systemd-resolved DNS sinkholing is unreliable as a primary control: long-running daemons can cache resolved A and AAAA records past rule reloads and can fall back to hardcoded IP literals. Combining systemctl mask with a narrow nftables or firewalld output drop chain provides a durable privacy and security boundary.
- Mask the trigger and service units: Run systemctl mask against both the .service and any associated .timer or .path units so package scripts cannot quietly re-enable them during routine maintenance.
- Apply a targeted output drop: Prefer a named drop matching the exact resolver name or daemon UID the unit actually uses over a blanket outbound deny. In nftables, configuring an inet filter output chain with a named set using a timeout 1h interval or an explicit skuid match isolates the specific reporter user ID (such as whoopsie or abrt) while leaving TCP port 443 and UDP port 123 open for package managers and systemd-timesyncd.
- Verify socket suppression: Run ss -tupn state established, syn-sent alongside a 10-to-15-minute tcpdump -ni any 'tcp[tcpflags] & tcp-syn!= 0' capture on the egress interface you administer while executing a forced systemctl start test of the target timer. A clean verification shows zero active or syn-sent sockets originating from the masked unit or its dedicated system user.
Daemon UID Matching: Filtering outbound packets by the collector's dedicated system user (skuid) stops traffic even if the upstream project rotates its ingest hostname mid-release.
The Quiet Failures a Wide Drop Rule Creates
Aggressive subnet blocking breaks core system administration tools when telemetry ingest servers share infrastructure with package mirrors or connectivity checks. Dropping entire /24 ranges belonging to distribution infrastructure can affect package metadata refreshes, NTP synchronization, and NetworkManager connectivity checks.
NetworkManager connectivity checks poll a distribution-hosted HTTP endpoint on the order of every 300 seconds by default; if an overly broad IP drop catches that host, the desktop environment can display a false captive-portal warning within 5 minutes. Shared CDN endpoints or mirror networks caught in a wide drop rule will similarly fail closed, halting unattended security updates, clock discipline, or first-boot network detection.
There is also an operational trade-off with crash handlers: blocking crash uploaders stops unsolicited inventory reports, but it simultaneously kills automated kernel oops and userspace coredump submissions that some administrators deliberately retain for debugging workstation instability.
A mask in /etc/systemd/system survives a reboot, yet major distribution upgrades occurring every 6 to 24 months frequently rename systemd unit files or split monolithic reporter packages into sub-packages, bypassing existing symlink masks. Re-auditing unit files after an upgrade is part of the control itself.
Which of Those Flows Are You Keeping?
To establish a baseline for ongoing host auditing, filter your egress logs down to the minimal set of outbound sockets required for unattended security patching and clock accuracy. On a quiet server or workstation running without active web tools, browsers, or Flatpak background updaters, recurring outbound flows can include UDP port 123 for NTP, TCP port 80 and 443 for repository mirror refreshes, and UDP or TCP port 53 for local resolver queries.
Post-upgrade socket audits use systemctl list-timers --all and nft list ruleset to confirm no newly installed package has introduced an unmasked sender. After those reporter units are masked and their documented destinations are dropped, which remaining outbound connections are you prepared to justify on this machine?
