In Ubuntu Server and other systemd-based Linux distributions, systemd-random-seed.service is a boot-time service responsible for loading a random seed from disk (usually /var/lib/systemd/random-seed) into the kernel’s entropy pool (/dev/urandom) at startup, and saving a new seed at shutdown. While crucial for ensuring cryptographic randomness early in the boot process on standard hardware, this service can become a liability or produce predictable entropy in highly specialized, strict enterprise environments. In virtualized deployments utilizing virtio-rng, hardware security modules (HSMs), or air-gapped systems utilizing dedicated hardware random number generators (HRNGs) for absolute cryptographic certainty, allowing systemd to manage the seed file from standard disk storage creates an unnecessary abstraction and a potential attack vector for seed manipulation.
This guide explains how to completely disable the systemd-random-seed service in Ubuntu Server, enforcing absolute reliance on hardware-backed or hypervisor-provided entropy generation.
Stop and Mask the systemd-random-seed Service
Because systemd-random-seed.service is a foundational component executed very early in the boot sequence (required by sysinit.target), a simple systemctl disable command is fundamentally insufficient. Systemd will automatically pull it in to satisfy dependencies. To guarantee the init system is physically prevented from interacting with the kernel entropy pool via this specific disk-based mechanism, we must explicitly mask the unit file.
- Log into your Ubuntu Server via SSH using an account with
sudoprivileges. - Stop the service to prevent it from saving a new seed during the current session (though its primary job is done at boot/shutdown):
sudo systemctl stop systemd-random-seed.service - Disable the service to remove it from standard systemd targets:
sudo systemctl disable systemd-random-seed.service - For absolute certainty, explicitly mask the service. This symlinks the unit file to
/dev/null, creating a hard cryptographic block against it being invoked during the startup sequence:sudo systemctl mask systemd-random-seed.service - Warning: Do not perform this action unless your kernel is specifically configured to draw entropy from a trusted hardware source (e.g., TPM, HSM, or VirtIO RNG) early in boot. Without a reliable entropy source, cryptographic operations (like SSH key generation or TLS handshakes) will stall or fail.
Verify the Service Lockdown
By masking systemd-random-seed, you guarantee that systemd will completely bypass disk-based seed restoration, forcing the kernel to rely exclusively on your vetted hardware entropy infrastructure.
To verify the lockdown is successful, attempt to start the service manually:
sudo systemctl start systemd-random-seed.serviceSystemd will return a fatal error stating that the unit is masked (e.g., Failed to start systemd-random-seed.service: Unit systemd-random-seed.service is masked). You have successfully neutralized the automated systemd entropy seeding daemon, hardening your server’s state logic for specialized cryptographic deployments.