{
  "id": "CB-UBU-AUTH-030",
  "standard": "ubuntu",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-AUTH-030",
  "json": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-AUTH-030.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-AUTH-030.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-AUTH-030",
    "title": "Turn off MOTD content fetched from the network (motd-news, update-notifier)",
    "finding": {
      "title": "The system contacts Canonical servers to build the message of the day",
      "description": "The news fetch sends the release, kernel, CPU model and cloud type to an outside server, and its answer is shown to every user at login."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "automated",
    "tags": [
      "motd",
      "privacy",
      "network",
      "services"
    ],
    "description": "Two timers refresh parts of the Ubuntu message of the day from the network:\n\n- `motd-news.timer` (package `base-files`) runs `/etc/update-motd.d/50-motd-news --force` twice\n  a day. It downloads short news from `https://motd.ubuntu.com` and caches them in\n  `/var/cache/motd-news`, shown at every login. Its HTTP user agent carries the distribution\n  and version, the kernel release and architecture, the CPU model and the cloud type. It is\n  controlled by `ENABLED` in `/etc/default/motd-news`.\n- `update-notifier-motd.timer` and its service (package `update-notifier-common`, from Ubuntu\n  22.04 on servers) check weekly whether a new Ubuntu release is available, and update the\n  message shown by `91-release-upgrade`.\n\nThis control sets `ENABLED=0` in `/etc/default/motd-news` and masks the timers and the\n`update-notifier-motd` service.\n",
    "rationale": "The news request is an unsolicited outbound connection that describes the system to a third\nparty, from servers that otherwise only talk to approved repositories. Its content, chosen by an\noutside server, is displayed to every user who logs in. Release upgrade notices are useless on\nmanaged systems, where upgrades are planned centrally.\n",
    "impact": "The message of the day no longer shows Ubuntu news, nor the notice that a new release is\navailable. Package update counts (`90-updates-available`) and reboot notices are not affected;\nsecurity updates are covered by the package controls.\n",
    "notes": "The `91-release-upgrade` script can still check for a new release when someone logs in, through\n`/usr/lib/ubuntu-release-upgrader/release-upgrade-motd`; set `Prompt=never` in\n`/etc/update-manager/release-upgrades` to stop it too. On Ubuntu 20.04 servers,\n`update-notifier-motd` is not installed and its checks are reported as compliant.\n",
    "setting": {
      "location": "/etc/default/motd-news; units motd-news.timer, update-notifier-motd.timer, update-notifier-motd.service",
      "default_value": "ENABLED=1, timers enabled",
      "recommended_value": "ENABLED=0, timers and service masked"
    },
    "audit": {
      "manual": "1. `grep ENABLED /etc/default/motd-news` shows `ENABLED=0`.\n2. `systemctl is-enabled motd-news.timer update-notifier-motd.timer update-notifier-motd.service`\n   prints `masked` for each unit that exists.\n",
      "checks": [
        {
          "id": "motd-news-config",
          "engine": "shell",
          "description": "Effective ENABLED value in /etc/default/motd-news.",
          "spec": {
            "script": "f=/etc/default/motd-news\n[ -f \"$f\" ] || { echo \"no $f\"; exit 2; }\nv=$(sed -n 's/^[[:space:]]*ENABLED[[:space:]]*=[[:space:]]*\"\\{0,1\\}\\([0-9]*\\).*/\\1/p' \"$f\" | tail -n 1)\necho \"ENABLED=${v:-unset}\"\n[ \"$v\" = 0 ]\n"
          }
        },
        {
          "id": "motd-news-timer",
          "engine": "systemd-unit",
          "description": "The motd-news download timer is masked.",
          "spec": {
            "unit": "motd-news.timer",
            "state": "masked"
          }
        },
        {
          "id": "update-notifier-timer",
          "engine": "systemd-unit",
          "description": "The update-notifier-motd timer is masked.",
          "spec": {
            "unit": "update-notifier-motd.timer",
            "state": "masked"
          }
        },
        {
          "id": "update-notifier-service",
          "engine": "systemd-unit",
          "description": "The update-notifier-motd service is masked.",
          "spec": {
            "unit": "update-notifier-motd.service",
            "state": "masked"
          }
        }
      ]
    },
    "remediation": {
      "manual": "1. In `/etc/default/motd-news`, set `ENABLED=0`.\n2. Run `systemctl mask --now motd-news.timer update-notifier-motd.timer update-notifier-motd.service`.\n",
      "effects": {
        "restart": "none",
        "disruption": "none",
        "lockout_risk": false
      },
      "rollback": "Set `ENABLED=1` in `/etc/default/motd-news`, then run `systemctl unmask` and\n`systemctl enable --now` for `motd-news.timer` and `update-notifier-motd.timer`, and\n`systemctl unmask update-notifier-motd.service`.\n",
      "scripts": [
        {
          "id": "motd-news-config",
          "engine": "shell",
          "content": "f=/etc/default/motd-news\n[ -f \"$f\" ] || exit 0\ncb_backup \"$f\"\nif grep -Eq '^[[:space:]]*ENABLED[[:space:]]*=' \"$f\"; then\n  sed -i 's/^[[:space:]]*ENABLED[[:space:]]*=.*/ENABLED=0/' \"$f\"\nelse\n  printf '%s\\n' 'ENABLED=0' >>\"$f\"\nfi\n"
        },
        {
          "id": "motd-news-timer",
          "from_check": "motd-news-timer"
        },
        {
          "id": "update-notifier-timer",
          "from_check": "update-notifier-timer"
        },
        {
          "id": "update-notifier-service",
          "from_check": "update-notifier-service"
        }
      ]
    },
    "references": [
      {
        "title": "update-motd(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/update-motd.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "Ubuntu Server documentation - pam_motd",
        "url": "https://documentation.ubuntu.com/server/reference/other-tools/pam-motd/",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "Canonical legal - MOTD information",
        "url": "https://canonical.com/legal/motd",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "systemctl(1), Ubuntu manual pages (mask)",
        "url": "https://manpages.ubuntu.com/manpages/noble/man1/systemctl.1.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R62",
        "relation": "partial",
        "note": "R62 asks to disable every unneeded service; this control covers the MOTD network timers."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1082"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-AUTH-002",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Fails on a fresh install (ENABLED=1, motd-news.timer enabled; update-notifier-motd not installed, compliant); fix masks the timer; kept after reboot; fix idempotent."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Fails on a fresh install (ENABLED=1, motd-news and update-notifier-motd timers enabled); fix masks the units; kept after reboot; fix idempotent."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Fails on a fresh install (ENABLED=1, motd-news and update-notifier-motd timers enabled); fix masks the units; kept after reboot; fix idempotent."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Fails on a fresh install (ENABLED=1, motd-news and update-notifier-motd timers enabled); fix masks the units; kept after reboot; fix idempotent."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}