The uuidd (Universally Unique Identifier Daemon) is a background service in Ubuntu designed to generate time-based UUIDs in a secure and guaranteed unique manner. It is primarily utilized by high-performance database applications, cluster filesystems, or specific enterprise software that require thousands of sequentially unique identifiers per second without risk of collision across multiple threads. On a standard web server, file server, or basic application server, the kernel’s built-in /proc/sys/kernel/random/uuid generator is more than sufficient. The uuidd daemon sits idle, consuming a small amount of memory and running under a dedicated user account, adding unnecessary complexity to a minimalist deployment.
This guide explains how to completely disable the uuidd daemon in Ubuntu Server, freeing up resources and reducing the attack surface on systems that do not require high-throughput UUID generation.
Stop and Mask the UUID Daemon
Because uuidd relies on socket activation (it only spins up when an application specifically requests a UUID via its UNIX socket), simply stopping it is not enough. The next time an application queries the socket, systemd will spawn the daemon again. We must disable and aggressively mask both the service and the socket.
- Log into your Ubuntu Server via SSH using an account with
sudoprivileges. - First, stop both the service and the socket:
sudo systemctl stop uuidd.service uuidd.socket - Next, disable both to prevent them from loading on the next boot:
sudo systemctl disable uuidd.service uuidd.socket - Finally, to guarantee that they cannot be invoked by dependency resolution or rogue socket calls, mask them entirely:
sudo systemctl mask uuidd.service uuidd.socket
Verify the Service Lockdown
By masking the units, you have symlinked them to /dev/null, ensuring the systemd manager will immediately reject any attempt to start them.
To verify the lockdown is successful, run the following command to check the status:
systemctl status uuidd.service uuidd.socketThe output will clearly state that both units are masked. Additionally, you can check that the socket file (usually located at /run/uuidd/request) no longer exists or is unresponsive. You have successfully optimized your server by removing an unnecessary background daemon.