How to Completely Disable the ‘systemd-timedated’ Service in Ubuntu Server

In Ubuntu Server, systemd-timedated.service is a D-Bus activated system service tasked with managing the system clock, time zone, and synchronizing time over the network via NTP (Network Time Protocol) settings. It provides a standardized interface for user-space utilities (like timedatectl) to interact with the kernel’s real-time clock (RTC) and update the /etc/localtime and /etc/timezone configuration files. While convenient for generic desktop and dynamic server environments, relying on a D-Bus activated daemon to manage time is often unacceptable in highly specialized, air-gapped architectures. In strict zero-trust or containerized environments, time synchronization must be handled by dedicated, hardened daemons (like chronyd or strict ntpd configurations), and arbitrary user-space manipulation of the system clock via systemd APIs must be explicitly suppressed to prevent time-shifting attacks.

This guide explains how to completely disable the systemd-timedated service in Ubuntu Server, ensuring absolute suppression of automated clock management via systemd’s D-Bus interface.

Stop and Mask the systemd-timedated Service

To guarantee that this service cannot execute and modify the system clock or timezone configurations, we must disable and explicitly mask the unit file.

1. Log into your Ubuntu Server via SSH using an account with sudo privileges.
2. First, stop the active service:

   sudo systemctl stop systemd-timedated.service

3. Next, disable the service to remove it from the systemd boot schedule:

   sudo systemctl disable systemd-timedated.service

4. For absolute certainty, explicitly mask the service. This symlinks the unit file to /dev/null, creating a hard block against it being activated by D-Bus requests under any circumstances:

   sudo systemctl mask systemd-timedated.service

Verify the Service Lockdown

By masking systemd-timedated.service, you guarantee that systemd will completely ignore the unit, severing the D-Bus API connection to the kernel’s time management subsystem.

To verify the lockdown is successful, attempt to query the time status using the standard systemd utility:

timedatectl status

Systemd will return a fatal D-Bus connection error stating that the service cannot be activated (e.g., Failed to query server: Unit systemd-timedated.service is masked). You have successfully neutralized the automated systemd time manager, hardening your server’s runtime environment and ensuring compliance with strict, immutable infrastructure requirements where time must be managed out-of-band.