How to Completely Disable the ‘snmpd’ Daemon in Ubuntu Server

The snmpd daemon is a background service in Ubuntu Server that implements the Simple Network Management Protocol (SNMP). It is used to expose critical system metrics (CPU usage, memory, interface traffic, and disk I/O) to centralized monitoring servers (like Zabbix, PRTG, or Datadog). While SNMP is an industry standard for network monitoring, it is often installed by default on certain cloud images but left unconfigured. Running an unconfigured SNMP daemon, especially SNMPv1 or v2c which transmit data in plaintext, exposes a massive attack surface. If your server is directly facing the internet or you rely entirely on modern, agent-based monitoring (like the Datadog Agent or Prometheus Node Exporter), you should completely disable snmpd.

This guide explains how to completely disable the snmpd daemon in Ubuntu Server.

Stop and Disable the SNMP Daemon

To secure the server and stop it from listening on UDP port 161, we must halt the daemon and explicitly mask it via systemd.

1. Log into your Ubuntu Server via SSH or local console using an account with sudo privileges.
2. First, stop the active service to immediately close the listening UDP port:

   sudo systemctl stop snmpd.service

3. Next, disable the service so it does not initialize during the next system boot:

   sudo systemctl disable snmpd.service

4. To guarantee that no other dependent monitoring scripts can accidentally invoke the daemon, mask the service unit entirely:

   sudo systemctl mask snmpd.service

Verify the Port Closure

By masking the service, you have effectively severed the SNMP listener from the operating system, hardening your server’s network profile.

To verify the lockdown is successful, run the following command to check the status of the unit:

systemctl status snmpd.service

The output will clearly state that the service is masked (symlinked to /dev/null) and the Active state will read inactive (dead). More importantly, execute the sudo ss -ulnp | grep 161 command. The output should be completely blank, confirming that your Ubuntu Server is no longer listening for inbound SNMP polling requests on UDP port 161, successfully eliminating that potential attack vector.