How to Completely Disable the ‘systemd-sysusers’ Service in Ubuntu Server

In Ubuntu Server and other systemd-based Linux distributions, systemd-sysusers.service is a core boot-time component responsible for reading declarative configuration files in /usr/lib/sysusers.d/ and automatically creating system users and groups required by newly installed packages. While highly efficient for stateless systems or automated OS image building, relying on systemd-sysusers introduces unpredictability in strict, zero-trust enterprise environments or hardened enclaves. In highly secure deployments, the creation of users and groups MUST be strictly controlled via centralized Identity and Access Management (IAM) systems (like LDAP/FreeIPA) or heavily audited, manual Configuration Management tools (like Ansible or Chef). Allowing systemd to dynamically alter /etc/passwd and /etc/group during boot bypasses these controls.

This guide explains how to completely disable the systemd-sysusers service in Ubuntu Server, enforcing absolute external or manual control over local account creation.

Stop and Mask the systemd-sysusers Service

Because systemd-sysusers.service is a foundational component executed very early in the boot process (often before the network is fully up), simply running systemctl disable is fundamentally insufficient. It will almost certainly be pulled in as a dependency by sysinit.target. To guarantee the init system is physically prevented from altering user databases under any circumstances, we must explicitly mask the unit file.

1. Log into your Ubuntu Server via SSH using an account with sudo privileges.
2. Since this service usually runs only once during boot, stopping it on a running system is largely symbolic, but we execute the command for completeness:

   sudo systemctl stop systemd-sysusers.service

3. Disable the service to remove it from standard systemd targets:

   sudo systemctl disable systemd-sysusers.service

4. For absolute certainty, explicitly mask the service. This symlinks the unit file to /dev/null, creating a hard cryptographic block against it being invoked during the startup sequence:

   sudo systemctl mask systemd-sysusers.service

5. Warning: Masking this service means that if you install a new .deb package that relies on a specific system user (e.g., postgres or nginx) being created dynamically by sysusers, the installation or the service will fail until you manually provision the account.

Verify the Service Lockdown

By masking systemd-sysusers, you guarantee that systemd will completely bypass declarative user creation, leaving the management of /etc/passwd strictly to your vetted IAM infrastructure or manual administrative procedures.

To verify the lockdown is successful, attempt to start the service manually:

sudo systemctl start systemd-sysusers.service

Systemd will return a fatal error stating that the unit is masked (e.g., Failed to start systemd-sysusers.service: Unit systemd-sysusers.service is masked). You have successfully neutralized the automated systemd account provisioning daemon, hardening your server’s state logic and ensuring compliance with strict, externally managed deployment pipelines.