How to Completely Disable the ‘pollinate’ Daemon in Ubuntu Server

The pollinate daemon is a background utility installed in Ubuntu Server cloud images (especially those deployed on AWS, Azure, or DigitalOcean) that attempts to seed the system’s pseudo-random number generator (PRNG) during the initial boot sequence. It does this by reaching out to an external Entropy-as-a-Service (EaaS) provider, typically entropy.ubuntu.com, to fetch cryptographic randomness over HTTPS. While useful for securing SSH keys on the very first boot of a lightweight virtual machine, continuous subsequent polling is completely unnecessary on modern hypervisors that pass through hardware RNG devices (like virtio-rng). Furthermore, highly secure, air-gapped servers should never attempt to connect to external Canonical servers.

This guide explains how to completely disable the pollinate daemon in Ubuntu Server to prevent external network calls for entropy.

Stop and Disable the Pollinate Daemon

To ensure the server relies solely on its local hardware or hypervisor-provided entropy pool, we must disable and mask the service via systemd.

1. Log into your Ubuntu Server via SSH or local console using an account with sudo privileges.
2. First, ensure the active service is stopped (though it typically runs as a one-shot service, it is best practice to stop it):

   sudo systemctl stop pollinate.service

3. Next, disable the service so it does not attempt to contact entropy.ubuntu.com during the next boot sequence:

   sudo systemctl disable pollinate.service

4. To guarantee that cloud-init or other provisioning scripts cannot accidentally resurrect the daemon, mask the service unit entirely:

   sudo systemctl mask pollinate.service

Verify the Local Entropy Pool

By masking the service, you have effectively severed the server’s reliance on external entropy sources without uninstalling the package, which satisfies strict egress firewall rules.

To verify the lockdown is successful, run the following command to check the status of the unit:

systemctl status pollinate.service

The output will clearly state that the service is masked (symlinked to /dev/null) and the Active state will read inactive (dead). You can confidently rely on the fact that your cryptographic keys and SSL certificates are now being generated exclusively using randomness sourced from your local physical or virtual hardware, keeping your network traffic perfectly contained.