In Ubuntu Server and other systemd-based Linux distributions, systemd-hibernate-resume.service is a boot-time service designed to seamlessly resume the system state from a designated swap partition or file if the machine was previously placed into hibernation (suspend-to-disk). While useful for desktop workstations or laptops seeking to preserve active session data across power cycles, this service is entirely unnecessary and potentially problematic in strict, zero-trust server environments or ephemeral cloud instances. On dedicated servers, Kubernetes nodes, or air-gapped appliances, hibernation is strictly forbidden as it writes sensitive RAM contents (including decrypted keys and active session tokens) to non-volatile storage. Leaving the resume service active wastes boot cycles attempting to locate a hibernation image and introduces a theoretical attack vector where a malicious hibernation image could be injected into swap.
This guide explains how to completely disable the systemd-hibernate-resume service in Ubuntu Server, enforcing an absolute block on state-restoration mechanisms and guaranteeing clean, cold boots.
Stop and Mask the systemd-hibernate-resume Service
Because systemd-hibernate-resume.service is a foundational component tied deeply to sysinit.target and the systemd generator logic (which checks kernel command-line parameters like resume=), a simple systemctl disable command is fundamentally insufficient. The init system will automatically pull it in during early boot if certain conditions are met. To guarantee systemd is physically prevented from executing the resume logic under any circumstances, we must explicitly mask the unit file.
- Log into your Ubuntu Server via SSH using an account with
sudoprivileges. - Disable the service to remove it from standard systemd targets:
sudo systemctl disable systemd-hibernate-resume.service - For absolute certainty, explicitly mask the service. This symlinks the unit file to
/dev/null, creating a hard cryptographic block against it being invoked during the startup sequence or triggered via the systemd generator:sudo systemctl mask systemd-hibernate-resume.service - Note: To ensure comprehensive lockdown, administrators should also disable the complementary suspend/hibernate targets (e.g., `sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target`).
Verify the Service Lockdown
By masking systemd-hibernate-resume, you guarantee that systemd will completely bypass any attempt to restore memory state from disk, forcing the kernel to initiate a clean initialization sequence on every power cycle.
To verify the lockdown is successful, attempt to start the service manually:
sudo systemctl start systemd-hibernate-resume.serviceSystemd will return a fatal error stating that the unit is masked (e.g., Failed to start systemd-hibernate-resume.service: Unit systemd-hibernate-resume.service is masked). You have successfully neutralized the automated state-restoration daemon, hardening your server’s boot logic and ensuring compliance with strict, ephemeral deployment pipelines.