The Directory Service Redundancy
In Ubuntu Server environments, the System Security Services Daemon (SSSD) is the standard tool for connecting a Linux machine to centralized authentication directories like Active Directory or LDAP. The core of SSSD is highly modular, and one of its most critical components is the sssd-nss.service. This daemon interfaces with the Name Service Switch (NSS), allowing the Linux operating system to seamlessly look up user IDs, group memberships, and sudo rules from the remote LDAP server exactly as if they were local users in the /etc/passwd file.
However, if you have installed the SSSD package but are not actually using it to pull user data from a central directory (perhaps you installed it solely for its DBus interface, or as a dependency for another application, or you changed your mind and went back to local authentication), leaving the NSS module running is a bad practice. It will needlessly intercept system calls for user information, slowing down local lookups slightly as it checks an empty or unconfigured database cache. It should be disabled.
How to Disable the SSSD NSS Module
You can shut down this specific identity lookup module using systemctl.
Warning: Do not do this if your server is actively joined to an LDAP or Active Directory domain. Disabling this will instantly break the server’s ability to recognize remote users and groups, likely locking you out.
- Open your Ubuntu Terminal or connect via SSH.
- Stop the active service socket (if it is running):
sudo systemctl stop sssd-nss.socket- Stop the daemon itself:
sudo systemctl stop sssd-nss.service- Disable both to prevent them from starting on boot:
sudo systemctl disable sssd-nss.socket
sudo systemctl disable sssd-nss.serviceYour Ubuntu server will now rely exclusively on local files (or other configured NSS modules) for user and group resolution, completely bypassing the unused SSSD framework.