The Redundant SSH Integration
The System Security Services Daemon (SSSD) is a comprehensive framework used in enterprise Linux environments to connect local machines to centralized identity providers like Active Directory, LDAP, or FreeIPA. SSSD is highly modular. One of its specific modules is the sssd-ssh.service. This daemon is designed to integrate SSSD with the OpenSSH server, allowing it to fetch SSH public keys directly from the central LDAP/Active Directory server, rather than relying on local ~/.ssh/authorized_keys files.
While this is a brilliant feature for managing developer access across hundreds of servers via a central directory, it is entirely redundant if you are using SSSD merely for basic LDAP password authentication, or if you still manage your SSH keys manually via local files or a configuration management tool like Ansible. If your organization does not store user SSH keys within its central directory schema, the sssd-ssh daemon is just wasting a tiny amount of memory. It should be disabled to harden the server.
How to Disable the SSSD SSH Daemon
You can stop this specific identity module using systemctl.
Warning: Do not do this if your enterprise environment relies on FreeIPA or Active Directory to distribute SSH public keys to target servers. Disabling this will lock users out of SSH if they do not have local keys.
- Open your Ubuntu Terminal or connect via SSH.
- Stop the currently active service socket (if running):
sudo systemctl stop sssd-ssh.socket- Stop the daemon itself:
sudo systemctl stop sssd-ssh.service- Disable both so they do not attempt to start on the next boot:
sudo systemctl disable sssd-ssh.socket
sudo systemctl disable sssd-ssh.serviceYour SSSD deployment will continue to handle standard password authentication and group lookups, but will no longer attempt to intercept SSH key requests.