I've been working my way down the basic security wiki https://wiki.ubuntu.com/BasicSecurity , and I came to this:
'Don't run services you don't need. Do you really need a VOIP phone system? What about Secure Shell (SSH), Virtual Network Computing (VNC), Apache server? If you need a service, make sure you understand it and can properly secure it. You can't secure what you don't understand. '
Seems like good advice (if you don't take it too literally - if I did I'd never turn the machine on).
But how do I find out what services are running?