The Redundant Kerberos Daemon
The System Security Services Daemon (SSSD) is a powerful framework in Ubuntu and other Linux enterprise environments used to manage access to remote identity and authentication resources (like Active Directory, LDAP, or FreeIPA). SSSD is modular, and one of its sub-components is the sssd-pac.service. The “PAC” stands for Privilege Attribute Certificate, a Microsoft-specific extension to Kerberos tickets used primarily within Active Directory environments to convey user authorization data.
If you have installed SSSD on an Ubuntu machine to authenticate against a standard LDAP directory, or if you are simply using local accounts and installed SSSD as a dependency for another tool, the PAC responder service is entirely redundant. It will sit in the background consuming a small amount of memory, waiting to process Kerberos PAC data that will never arrive. If your server is not joined to a Microsoft Active Directory domain, you should disable this specific responder daemon.
How to Disable the SSSD PAC Service
You can stop this specific authentication module using systemctl.
Warning: Do not do this if your Ubuntu machine is joined to an Active Directory domain via realmd/SSSD, as doing so will break group policy and authorization checks.
- Open your Ubuntu Terminal or connect via SSH.
- Stop the currently active service socket (if running):
sudo systemctl stop sssd-pac.socket- Stop the daemon itself:
sudo systemctl stop sssd-pac.service- Disable them so they do not attempt to start on the next boot:
sudo systemctl disable sssd-pac.socket
sudo systemctl disable sssd-pac.serviceYour SSSD deployment is now slightly leaner, omitting the Active Directory-specific Kerberos checks while maintaining standard LDAP or local authentication capabilities.