How to Completely Disable ‘Wpa_supplicant’ Daemon in Ubuntu Server

wpa_supplicant is a crucial daemon in the Linux networking stack responsible for managing wireless connections. It handles the complex cryptographic handshakes required for WPA and WPA2 protected Wi-Fi networks. On a laptop running Ubuntu Desktop, this daemon is absolutely essential. However, if you are running Ubuntu Server in a data centre, a virtual machine on a hypervisor, or on bare-metal hardware that is strictly hardwired to the network via Ethernet, your system will never need to authenticate with a wireless access point. Running wpa_supplicant in the background of a wired-only server wastes CPU cycles, consumes memory, and adds an unnecessary layer of complexity to network troubleshooting.

This guide explains how to completely disable and permanently mask the wpa_supplicant daemon in Ubuntu Server, ensuring it never runs on a wired machine.

Stop and Mask Wpa_supplicant via Systemctl

Because the network stack is highly interconnected, you should not attempt to remove the wpasupplicant package via apt remove. Doing so will likely break NetworkManager or netplan.io dependencies, potentially leaving your server completely disconnected from the network upon reboot. The correct administrative procedure is to mask the service.

1. Log into your Ubuntu Server as root or via a user with sudo privileges.
2. Check if the daemon is currently active and loaded into memory:

   sudo systemctl status wpa_supplicant.service

3. If it is running, immediately stop the daemon:

   sudo systemctl stop wpa_supplicant.service

4. Disable the service to prevent systemd from launching it during the boot process:

   sudo systemctl disable wpa_supplicant.service

5. Finally, apply a hard mask. This redirects any calls to start the service to /dev/null, ensuring that even if another networking script explicitly requests wpa_supplicant to wake up, the request will be silently ignored:

   sudo systemctl mask wpa_supplicant.service

Verify the Configuration

To confirm that the daemon has been neutralized, check its status one final time:

sudo systemctl status wpa_supplicant.service

The output must explicitly state Loaded: masked. Your server will now rely entirely on its wired Ethernet interfaces (e.g., eth0, eno1, or enp3s0) and will never attempt to process wireless cryptographic handshakes.