The networkd-dispatcher daemon is a service in Ubuntu designed to execute scripts in response to network state changes managed by systemd-networkd. Similar to the older NetworkManager-dispatcher.service, it allows administrators to trigger custom commands when interfaces go up, down, or obtain DHCP leases. While powerful for complex routing environments or laptops roaming between networks, it introduces a severe security risk on static, mission-critical servers. In 2022, a vulnerability (dubbed “Nimbuspwn”) in networkd-dispatcher was discovered that allowed local attackers to escalate privileges to root by exploiting how the daemon handled symlinks and script execution. If your server utilizes static IP configurations and does not require event-driven networking scripts, this daemon should be immediately neutralized.
This guide explains how to completely disable the networkd-dispatcher daemon in Ubuntu Server, eliminating an unnecessary vector for privilege escalation.
Stop and Mask the Networkd-Dispatcher Daemon
To ensure the systemd initialization sequence bypasses this daemon, we must disable the service and aggressively mask it to prevent any indirect dependencies or D-Bus calls from triggering it.
- Log into your Ubuntu Server via SSH using an account with
sudoprivileges. - First, check if the service is currently running and stop it:
sudo systemctl stop networkd-dispatcher.service - Next, disable the service to prevent it from loading on the next boot:
sudo systemctl disable networkd-dispatcher.service - To absolutely guarantee that it cannot be invoked by systemd or rogue scripts, mask it entirely:
sudo systemctl mask networkd-dispatcher.service
Verify the Service Lockdown
By masking the service, you have effectively symlinked its unit file to /dev/null, ensuring the systemd manager cannot execute it under any circumstances.
To verify the lockdown is successful, run the following command to check the status of the daemon:
systemctl status networkd-dispatcher.serviceThe output will clearly state that the service is masked. Because your server likely relies on static netplan configurations that are applied once at boot, the absence of this event dispatcher will not impact your core network connectivity, but it will significantly reduce your attack surface.