In Ubuntu Server and other systemd-based Linux distributions, systemd-journal-gatewayd.service is a micro-HTTP server daemon designed to expose the system’s local journald logs over a network REST API. When enabled, it allows administrators to remotely stream, query, and download the system’s binary journal (including kernel panics, authentication failures, and service statuses) directly via a web browser or curl using port 19531. While extremely useful for centralized, agentless log aggregation in trusted homelab environments, leaving this service active represents a catastrophic security vulnerability in production enterprise networks or internet-facing servers. Exposing the system’s core logging infrastructure over an unauthenticated HTTP socket allows malicious actors to perform deep reconnaissance, monitor security daemon failures in real-time, and extract sensitive data that may have been inadvertently logged by applications.
This guide explains how to completely disable the systemd-journal-gatewayd service in Ubuntu Server, enforcing an absolute block on remote HTTP log streaming and securing the system’s telemetry data.
Stop and Mask the systemd-journal-gatewayd Service
Because systemd-journal-gatewayd relies on systemd socket activation (meaning the daemon is dynamically spun up by systemd-journal-gatewayd.socket the moment a network request hits port 19531), a simple systemctl disable on the service unit is fundamentally insufficient. To guarantee the system is physically prevented from executing this HTTP log server, we must explicitly mask both the socket and the service units.
- Log into your Ubuntu Server via SSH using an account with
sudoprivileges. - Stop the socket and the service to immediately terminate any active log streaming connections:
sudo systemctl stop systemd-journal-gatewayd.socket systemd-journal-gatewayd.service - Disable both units to remove their explicit dependencies from the standard boot targets:
sudo systemctl disable systemd-journal-gatewayd.socket systemd-journal-gatewayd.service - For absolute certainty, explicitly mask both units. This symlinks the unit files to
/dev/null, creating a hard cryptographic block against them being invoked dynamically during the startup sequence or by incoming network traffic:sudo systemctl mask systemd-journal-gatewayd.socket systemd-journal-gatewayd.service
Verify the Service Lockdown
By masking the socket and service, you guarantee that systemd will actively reject any attempts to expose the journal over HTTP, ensuring logs remain localized and secure.
To verify the lockdown is successful, attempt to start the socket manually:
sudo systemctl start systemd-journal-gatewayd.socketSystemd will return a fatal error stating that the unit is masked (e.g., Failed to start systemd-journal-gatewayd.socket: Unit systemd-journal-gatewayd.socket is masked). Furthermore, running netstat -tuln | grep 19531 will confirm that the server is no longer listening on the network port, successfully neutralizing the unauthorized log streaming daemon.