How to Completely Disable the ‘nscd’ (Name Service Cache Daemon) Service in Ubuntu Server

In Ubuntu Server environments, nscd (Name Service Cache Daemon) is a background process that caches name service lookups, primarily DNS (hosts), passwords (passwd), and group queries. Its purpose is to improve system performance by serving frequently requested directory information from local memory rather than querying external LDAP servers, Active Directory domains, or DNS resolvers repeatedly. However, aggressive caching can lead to severe synchronization issues. If a user’s permissions change on a central LDAP server, or if a critical DNS record is updated during a failover event, an Ubuntu server running nscd might continue using stale, cached data, resulting in access denials or routing failures. In strictly managed, modern environments (especially those utilizing systemd-resolved or SSSD), nscd is often considered obsolete and a source of unpredictable behavior.

This guide explains how to completely disable the nscd service in Ubuntu Server, ensuring the OS always performs fresh, real-time directory lookups.

Stop and Disable the NSCD Service

To prevent the server from caching critical authentication and routing data, we must stop the daemon and disable it from launching during the boot sequence.

1. Log into your Ubuntu Server via SSH using an account with sudo privileges.
2. First, check if the service is currently running:

   sudo systemctl status nscd.service

3. If it is active, stop the service immediately, purging the active memory cache:

   sudo systemctl stop nscd.service

4. Next, disable the service to remove its symlinks from the multi-user boot target:

   sudo systemctl disable nscd.service

5. For absolute certainty, explicitly mask the service to prevent any other dependent target from invoking it:

   sudo systemctl mask nscd.service

Verify the Service Lockdown

By masking nscd.service, you guarantee that the server will bypass local caching for Name Service Switch (NSS) queries, prioritizing accuracy over microsecond-level performance gains.

To verify the lockdown is successful, attempt to start the service manually:

sudo systemctl start nscd.service

Systemd will return a fatal error stating that the unit is masked (e.g., Failed to start nscd.service: Unit nscd.service is masked). All subsequent DNS, passwd, and group queries will now be routed directly to their authoritative sources, eliminating the risk of stale cache conflicts in dynamic network architectures.