How to Completely Disable the ‘ntpd’ (NTP) Daemon in Ubuntu Server

The ntpd (Network Time Protocol daemon), historically provided by the ntp package, is a traditional background service used to synchronize the system clock with remote time servers over the network. While accurate timekeeping is essential, modern Ubuntu Server installations have largely deprecated ntpd in favor of systemd-timesyncd (for basic SNTP client needs) or chrony (for high-precision enterprise synchronization). If you have inherited a legacy server or a custom deployment where the old ntpd daemon is still running, it represents an unnecessary attack surface (NTP amplification attacks) and wastes resources if you are already utilizing the modern systemd ecosystem or if the server operates in an air-gapped environment where external NTP polling is impossible.

This guide explains how to completely disable the legacy ntpd daemon in Ubuntu Server.

Stop and Mask the NTP Daemon

To ensure the systemd initialization sequence bypasses the legacy time synchronization daemon, we must disable the service and aggressively mask it to prevent any indirect dependencies from triggering it.

1. Log into your Ubuntu Server via SSH using an account with sudo privileges.
2. First, check if the service is currently running and stop it:

   sudo systemctl stop ntp.service

   (Note: Depending on the specific package installed, the service name might be ntpd.service. Use systemctl list-units | grep ntp to confirm).
3. Next, disable the service to prevent it from loading on the next boot:

   sudo systemctl disable ntp.service

4. To absolutely guarantee that it cannot be invoked by legacy scripts or cron jobs, mask it entirely:

   sudo systemctl mask ntp.service

Verify the Service Lockdown

By masking the service, you have effectively symlinked its unit file to /dev/null, ensuring the systemd manager cannot execute it under any circumstances.

To verify the lockdown is successful, run the following command to check the status of the daemon:

systemctl status ntp.service

The output will clearly state that the service is masked. Additionally, you can run sudo netstat -tulnp | grep :123 or ss -tulnp | grep :123 to verify that the legacy daemon is no longer actively listening on UDP port 123. You have successfully optimized your system initialization sequence by removing an outdated time synchronization daemon.