Keep system details out of the message of the day

Description

After login, pam_motd shows /etc/motd and the output of the executable scripts in /etc/update-motd.d/. Debian ships 10-uname, which prints the kernel name, release, version and architecture.

Rationale

The kernel release tells an attacker who reached a shell which local privilege escalation exploits apply. There is no need to show it to every user at every login.

Impact

Users no longer see the kernel version at login. They can still run uname -a.

Setting

Audit

1. /etc/motd must not contain the escape sequences \m, \r, \s, \v or the OS name.
2. /etc/update-motd.d/10-uname must not be executable (ls -l).

Automated: every check must pass. Scanners report each check by its id.

motd-no-os

/etc/motd does not reveal the system version.

path: /etc/motd
pattern: \\[mrsv]|Debian GNU/Linux [0-9]
expect: no_match

uname-script

The 10-uname dynamic MOTD script is not executable.

path: /etc/update-motd.d/10-uname
owner: root
group: root
mode: '0644'

Remediation

1. Run chmod 644 /etc/update-motd.d/10-uname.
2. Remove OS names, versions and escape sequences from /etc/motd.

Rollback

Run chmod 755 /etc/update-motd.d/10-uname.

uname-script

Generated from check uname-script: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• pam_motd(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• motd(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle