Permanently Block a Service with systemctl mask

systemctl mask links a unit file to /dev/null so it cannot be started manually, at boot, or pulled in by other services.

LinuxservicesadministrationsystemdMedium risk

Run `sudo systemctl mask <unit>` to hard-block a service from ever starting, and `sudo systemctl unmask <unit>` to restore normal behavior.

01Command

Command

$ sudo systemctl mask nginx.service

02What it does

`systemctl disable` only removes boot-time enablement, but a masked unit is symlinked to /dev/null, so even a manual `systemctl start` or another unit pulling it in as a dependency fails. This is the reliable way to guarantee a service stays off, e.g. after switching from a distro package to a different implementation. Masking with --now (`systemctl mask --now <unit>`) also stops it immediately.

03Risk

RiskMedium risk

Requirementssystemd-based distribution.

!Warning: Masking system-critical units (like dbus or systemd-udevd) can render the system unbootable; mask only services you fully understand.

04Undo

Undo

$ sudo systemctl unmask nginx.service

05Sources

systemctl(1)
Arch Linux Manual Pages · technical · 2026-09-17
Evidence: mask UNIT...: Link unit file(s) specified on the command line to /dev/null, making it impossible to start them; unmask reverses this.

Last verified: 2026-09-17 · Category: System & Settings

06Related solutions

View and Override Unit Files with systemctl cat/edit

Linuxservicessystemdconfig

systemctl cat reveals a service's unit file plus every drop-in override; systemctl edit creates overrides without touching vendor files.

Medium risk ✓ 2026-09-17

Manage Your Own Services with systemctl --user

Linuxservicesusersystemd

systemd runs a per-user service manager: units in ~/.config/systemd/user/ can start at login without sudo.

Medium risk ✓ 2026-09-17

Set the Timezone with timedatectl

Linuxtimedatectltimezonesystemd

timedatectl lists, sets, and verifies the system timezone and NTP sync status on systemd distributions.

Medium risk ✓ 2026-09-17