How to Completely Disable ‘Rsync’ Daemon in Ubuntu Server

Rsync is an incredibly powerful, versatile command-line utility used for synchronising files and directories between two different locations, often over an SSH connection. It is the gold standard for Linux backups and remote file transfers. By default, most administrators use rsync strictly as an on-demand client tool. However, the rsync package in Ubuntu Server also includes a daemon component (rsync-daemon). When running as a daemon, it listens on TCP port 873, allowing clients to connect directly without SSH encryption. If you are not actively operating a public mirror or a secured internal rsync server, leaving this daemon running or enabled is an unnecessary security risk.

This guide explains how to completely disable and mask the Rsync daemon in Ubuntu Server, ensuring that the port remains closed while still allowing you to use rsync as a standard client command.

Stop and Mask the Rsync Daemon via Systemctl

Because you likely still need the rsync binary for your own outbound backup scripts, you cannot simply uninstall the package via apt remove rsync. Instead, you must use systemctl to permanently paralyze the background daemon component without affecting the client executable.

1. Log into your Ubuntu Server as root or via a user with sudo privileges.
2. First, stop the daemon if it is currently running in the background:

   sudo systemctl stop rsync.service

3. Next, disable the service to prevent systemd from attempting to load it during the boot sequence:

   sudo systemctl disable rsync.service

4. Finally, apply a systemd mask. Masking links the service configuration file to /dev/null. This guarantees that the service cannot be started manually, nor can it be started automatically by any dependency:

   sudo systemctl mask rsync.service

Verify the Port is Closed

After masking the daemon, you should verify that it is no longer listening on its default port (TCP 873).

You can check active network sockets using the ss (socket statistics) command:

sudo ss -tulpn | grep 873

If the daemon has been successfully disabled, this command will return completely empty output. You can now safely continue using the rsync command for your outbound, SSH-encrypted file transfers (e.g., rsync -avz /local/dir user@remote:/remote/dir), confident that your server is not needlessly exposing an unencrypted listener daemon to your network.