In modern Ubuntu Server and Desktop deployments, the Linux Vendor Firmware Service (LVFS) is deeply integrated into the operating system via a background daemon known as fwupd. This service automatically polls remote servers to check for, download, and prompt the installation of low-level firmware updates for your motherboard UEFI, SSDs, and attached peripherals.
While keeping firmware up to date is generally good practice for security and hardware compatibility, automated firmware management is highly undesirable in strict production environments. A flawed UEFI or disk firmware update can brick a server, corrupt data, or introduce critical stability issues. System administrators typically prefer to manage hardware firmware manually during scheduled maintenance windows, rather than relying on an automated daemon. If you want strict control over your hardware, you can completely disable fwupd in Ubuntu.
Why Disable the fwupd Daemon?
Administrators choose to disable automated firmware updates for several key reasons:
- Stability and Uptime: Firmware updates often require a full system reboot and carry a non-zero risk of bricking the hardware. Unattended firmware polling introduces unnecessary risk.
- Compliance and Baselining: Enterprise environments require servers to run specific, validated firmware versions.
fwupdcan drift the system away from the approved baseline. - Resource Conservation: Disabling the daemon stops unnecessary background polling and network requests to the LVFS servers, tightening the server’s network footprint.
How to Turn Off ‘fwupd’ in Ubuntu Server
Because fwupd operates as a standard systemd service, you can easily stop it and mask it to prevent it from ever starting automatically, even after a reboot or a package upgrade.
- Open your terminal or connect to your Ubuntu Server via SSH.
- First, stop the currently running service by executing the following command:
sudo systemctl stop fwupd.service - Next, disable the service so it does not start on boot:
sudo systemctl disable fwupd.service - To ensure that no other service, socket, or apt hook can accidentally trigger the daemon to start, you must mask it. Run:
sudo systemctl mask fwupd.service
Once masked, the system will symlink the service file to /dev/null. The fwupd daemon is now completely inert. Your Ubuntu server will no longer query the LVFS for hardware updates, leaving all firmware management entirely in your control.