How to Completely Disable the ‘iscsid’ (iSCSI Daemon) in Ubuntu Server

The iscsid (iSCSI Daemon) is a background service in Ubuntu Server responsible for implementing the control path of the iSCSI protocol, allowing your server to connect to remote storage arrays (SANs) over a standard TCP/IP network. If you are provisioning a robust enterprise database, iSCSI is essential for mounting those remote block devices. However, if your server relies entirely on local NVMe storage or cloud-native block storage (like AWS EBS), the iscsid service sits idle. Leaving an unused network storage daemon running unnecessarily consumes system resources and expands the potential attack surface of the server.

This guide explains how to completely disable the iscsid service in Ubuntu Server.

Stop and Disable the iSCSI Daemon

To neutralize the daemon, we must use systemctl to halt its current execution and remove it from the default boot sequence.

1. Log into your Ubuntu Server via SSH or local console using an account with sudo privileges.
2. First, stop the active service to terminate its process immediately:

   sudo systemctl stop iscsid.service

3. Next, disable the service so it does not start automatically during the next boot:

   sudo systemctl disable iscsid.service

4. The iSCSI daemon is also heavily tied to a corresponding socket (iscsid.socket), which can automatically wake the daemon if it detects incoming traffic. To ensure a complete lockdown, stop and disable the socket as well:

   sudo systemctl stop iscsid.socket

   sudo systemctl disable iscsid.socket

5. To absolutely prevent any other dependent service from starting the daemon, mask both units:

   sudo systemctl mask iscsid.service

   sudo systemctl mask iscsid.socket

Verify the Daemon is Dormant

With the service stopped, disabled, and masked, the iSCSI initiator is completely dead.

To verify the lockdown is successful, run the following command to check the status of the primary service:

systemctl status iscsid.service

The output will clearly indicate that the unit is masked (linking to /dev/null) and the Active state will read inactive (dead). Your server will no longer attempt to establish or accept iSCSI control connections, tightening your system security and freeing up kernel resources.