In Ubuntu Server and other modern Linux distributions, systemd-tpm2-setup.service is a specialized early-boot component designed to automatically interact with the system’s Trusted Platform Module (TPM) 2.0 chip. Specifically, it attempts to generate and store a highly entropy-rich cryptographic key within the TPM’s non-volatile RAM (NVRAM), which can subsequently be utilized by the kernel or systemd-cryptsetup for tasks like automatically unlocking LUKS-encrypted root volumes without human interaction (via the systemd-cryptenroll mechanism). While incredibly useful for automating full-disk encryption in physical desktop or mobile workstation scenarios, this service introduces severe instability in environments utilizing virtualized TPMs (vTPMs) that are frequently snapshotted, clustered, or migrated. In strict, headless server environments relying on network-bound disk encryption (like Tang/Clevis) or external key management servers, allowing systemd to independently manipulate the TPM at boot is an unacceptable operational risk.
This guide explains how to completely disable the systemd-tpm2-setup service in Ubuntu Server, ensuring absolute suppression of automated TPM NVRAM manipulation during the boot sequence.
Stop and Mask the systemd-tpm2-setup Service
Because this service executes extremely early in the boot process (often before network interfaces are fully initialized), simply issuing a ‘disable’ command is insufficient. We must explicitly mask the unit file to guarantee the systemd init process is physically prevented from executing it.
- Log into your Ubuntu Server via SSH using an account with
sudoprivileges. - Check if the service is currently active or loaded (it usually runs and exits immediately during early boot):
sudo systemctl status systemd-tpm2-setup.service - Disable the service to remove it from the systemd boot schedule targets:
sudo systemctl disable systemd-tpm2-setup.service - For absolute certainty, explicitly mask the service. This symlinks the unit file to
/dev/null, creating a hard cryptographic block against it being invoked by systemd under any circumstances:sudo systemctl mask systemd-tpm2-setup.service
Verify the Service Lockdown
By masking systemd-tpm2-setup.service, you guarantee that systemd will not attempt to generate or store its own internal cryptographic keys within the TPM, deferring all TPM interactions strictly to administrator-defined utilities or specialized cryptographic frameworks.
To verify the lockdown is successful, attempt to start the service manually:
sudo systemctl start systemd-tpm2-setup.serviceSystemd will return a fatal error stating that the unit is masked (e.g., Failed to start systemd-tpm2-setup.service: Unit systemd-tpm2-setup.service is masked). You have successfully neutralized the automated TPM provisioner, hardening your server’s early-boot environment and ensuring compliance with strict cryptographic key management requirements.