A security analyst is hardening a newly provisioned Linux web server that will only serve HTTPS traffic to the public internet. A port scan of the host reveals the following listening services: HTTPS (443), Telnet (23), FTP (21), SSH (22), and an unused SMTP relay (25). The organization requires remote administration to remain possible while eliminating unnecessary attack surface. Which services should the analyst disable to best harden this asset?