How to Completely Disable the ‘chrony’ Daemon in Ubuntu Server

chronyd is a highly versatile and accurate daemon for synchronizing the system clock via the Network Time Protocol (NTP). It is often the default time synchronization service on modern Ubuntu Server installations, replacing older implementations like ntpd or systemd-timesyncd. While maintaining precise time is critical for cryptography and database transactions, there are specific architectures where a local time daemon is undesirable. For example, in heavily restricted air-gapped environments without a local NTP stratum server, or inside certain virtualized containers where time is strictly dictated and synchronized by the host hypervisor (via VMware Tools or Hyper-V Integration Services), running a redundant chrony daemon simply wastes CPU cycles and memory.

This guide explains how to completely disable the chrony daemon in Ubuntu Server.

Stop and Mask the Chrony Daemon

To ensure the systemd initialization sequence bypasses the time synchronization daemon, we must disable the service and mask it to prevent any indirect dependencies from triggering it during boot.

1. Log into your Ubuntu Server via SSH using an account with sudo privileges.
2. First, stop the daemon to immediately halt any active network polling:

   sudo systemctl stop chrony.service

3. Next, disable the service to prevent it from loading on the next boot:

   sudo systemctl disable chrony.service

4. To guarantee that no other init script can accidentally invoke it, mask the service entirely:

   sudo systemctl mask chrony.service

Verify the Service Lockdown

By masking the service, you have effectively symlinked its unit file to /dev/null, ensuring the systemd manager cannot execute it under any circumstances.

To verify the lockdown is successful, run the following command to check the status of the daemon:

systemctl status chrony.service

The output will clearly state that the service is masked. Additionally, you can run sudo netstat -tulnp | grep chronyd or ss -tulnp | grep chronyd to verify that the daemon is no longer actively listening on UDP port 123. You have successfully optimized your system initialization sequence by removing a redundant time synchronization daemon.