Turn off MOTD content fetched from the network (motd-news, update-notifier)

Description

Two timers refresh parts of the Ubuntu message of the day from the network:

• motd-news.timer (package base-files) runs /etc/update-motd.d/50-motd-news --force twice a day. It downloads short news from https://motd.ubuntu.com and caches them in /var/cache/motd-news, shown at every login. Its HTTP user agent carries the distribution and version, the kernel release and architecture, the CPU model and the cloud type. It is controlled by ENABLED in /etc/default/motd-news.
• update-notifier-motd.timer and its service (package update-notifier-common, from Ubuntu 22.04 on servers) check weekly whether a new Ubuntu release is available, and update the message shown by 91-release-upgrade.

This control sets ENABLED=0 in /etc/default/motd-news and masks the timers and the update-notifier-motd service.

The 91-release-upgrade script can still check for a new release when someone logs in, through /usr/lib/ubuntu-release-upgrader/release-upgrade-motd; set Prompt=never in /etc/update-manager/release-upgrades to stop it too. On Ubuntu 20.04 servers, update-notifier-motd is not installed and its checks are reported as compliant.

Rationale

The news request is an unsolicited outbound connection that describes the system to a third party, from servers that otherwise only talk to approved repositories. Its content, chosen by an outside server, is displayed to every user who logs in. Release upgrade notices are useless on managed systems, where upgrades are planned centrally.

Impact

The message of the day no longer shows Ubuntu news, nor the notice that a new release is available. Package update counts (90-updates-available) and reboot notices are not affected; security updates are covered by the package controls.

Setting

Audit

1. grep ENABLED /etc/default/motd-news shows ENABLED=0.
2. systemctl is-enabled motd-news.timer update-notifier-motd.timer update-notifier-motd.service prints masked for each unit that exists.

Automated: every check must pass. Scanners report each check by its id.

motd-news-config

Effective ENABLED value in /etc/default/motd-news.

script: |
  f=/etc/default/motd-news
  [ -f "$f" ] || { echo "no $f"; exit 2; }
  v=$(sed -n 's/^[[:space:]]*ENABLED[[:space:]]*=[[:space:]]*"\{0,1\}\([0-9]*\).*/\1/p' "$f" | tail -n 1)
  echo "ENABLED=${v:-unset}"
  [ "$v" = 0 ]

motd-news-timer

The motd-news download timer is masked.

unit: motd-news.timer
state: masked

update-notifier-timer

The update-notifier-motd timer is masked.

unit: update-notifier-motd.timer
state: masked

update-notifier-service

The update-notifier-motd service is masked.

unit: update-notifier-motd.service
state: masked

Remediation

1. In /etc/default/motd-news, set ENABLED=0.
2. Run systemctl mask --now motd-news.timer update-notifier-motd.timer update-notifier-motd.service.

Rollback

Set ENABLED=1 in /etc/default/motd-news, then run systemctl unmask and systemctl enable --now for motd-news.timer and update-notifier-motd.timer, and systemctl unmask update-notifier-motd.service.

motd-news-config

f=/etc/default/motd-news
[ -f "$f" ] || exit 0
cb_backup "$f"
if grep -Eq '^[[:space:]]*ENABLED[[:space:]]*=' "$f"; then
  sed -i 's/^[[:space:]]*ENABLED[[:space:]]*=.*/ENABLED=0/' "$f"
else
  printf '%s\n' 'ENABLED=0' >>"$f"
fi

motd-news-timer

Generated from check motd-news-timer: the engine writes the fix for every output, it sets the expected value and the check runs again after.

update-notifier-timer

Generated from check update-notifier-timer: the engine writes the fix for every output, it sets the expected value and the check runs again after.

update-notifier-service

Generated from check update-notifier-service: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• update-motd(5), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• Ubuntu Server documentation - pam_motd Canonical, vendor-doc, accessed 2026-10-19
• Canonical legal - MOTD information Canonical, vendor-doc, accessed 2026-10-19
• systemctl(1), Ubuntu manual pages (mask) Canonical, vendor-doc, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-UBU-AUTH-002 Keep system details out of the message of the day

People and lifecycle