In Ubuntu Server and other modern Linux distributions, systemd-network-generator.service is an early-boot systemd component responsible for translating legacy network configuration formats or kernel command-line parameters (such as ip= or net.ifnames=) into native systemd-networkd configuration files (.network, .netdev, or .link). While useful in PXE-booted environments, transient live CDs, or legacy cloud init scenarios where the kernel passes dynamic network parameters to user-space, this automated translation daemon introduces an unacceptable layer of unpredictability in highly secure, statically defined infrastructure. In strict zero-trust or immutable environments, all network interfaces, bonding, and IP addressing must be cryptographically defined by static configuration files (like Netplan or hardcoded systemd-networkd files); allowing a generator to dynamically interpret kernel parameters and spawn overriding network configurations creates a severe vector for network misconfiguration or hijacking.
This guide explains how to completely disable the systemd-network-generator service in Ubuntu Server, ensuring absolute suppression of dynamic network configuration generation during the boot sequence.
Stop and Mask the systemd-network-generator Service
Because this is a generator that runs very early in the boot process (often before standard services), simply disabling it is insufficient. We must explicitly mask the unit file to guarantee the systemd init process cannot execute it.
- Log into your Ubuntu Server via SSH using an account with
sudoprivileges. - Check if the service is currently active or loaded (it usually runs and exits during boot):
sudo systemctl status systemd-network-generator.service - Disable the service to remove it from the systemd boot schedule targets:
sudo systemctl disable systemd-network-generator.service - For absolute certainty, explicitly mask the service. This symlinks the unit file to
/dev/null, creating a hard cryptographic block against it being invoked by systemd during the early boot generator phase:sudo systemctl mask systemd-network-generator.service
Verify the Service Lockdown
By masking systemd-network-generator.service, you guarantee that systemd will strictly rely on your explicitly defined configuration files in /etc/systemd/network/ or /etc/netplan/, completely ignoring any legacy network parameters passed by the bootloader.
To verify the lockdown is successful, attempt to start the service manually:
sudo systemctl start systemd-network-generator.serviceSystemd will return a fatal error stating that the unit is masked (e.g., Failed to start systemd-network-generator.service: Unit systemd-network-generator.service is masked). You have successfully neutralized the automated network configuration generator, hardening your server’s early-boot environment and ensuring compliance with strict, immutable infrastructure requirements where networking must be statically defined.