Detections
Analytics

1.6.12 Ensure update-notifier-motd.timer is not in use

Information

update-notifier-motd.timer is the systemd timer shipped on Ubuntu by the update-notifier-common package. It periodically activates update-notifier-motd.service, which in turn refreshes the dynamic MOTD fragments under /var/lib/update-notifier/ (the "N packages can be updated, M are security updates" content surfaced by pam_motd ) and drives the motd-news integration via /etc/update-motd.d/50-motd-news.

Note:

 - update-notifier-motd.timer is not present on Debian 13 - the update-notifier-common package is Ubuntu-specific. On systems where the unit is not installed, this recommendation passes by default.
 - The timer is the recurring trigger for the dynamic MOTD refresh. The matching service rule must also be addressed; see also the recommendation covering update-notifier-motd.service.

Even when the companion service is masked, an unmasked recurring timer continues to schedule activations, generating journal noise and leaving a re-enablement path open (an attacker or operator with write access to the unit directories can unmask the service and the timer's existing schedule will immediately resume driving it). Masking the timer removes the recurring trigger, ensuring the dynamic MOTD refresh cannot resume without explicit administrative action on both units.

Solution

- IF - update-notifier-motd.timer is installed (Ubuntu), run the following commands to stop and mask the unit:

# systemctl stop update-notifier-motd.timer
# systemctl mask update-notifier-motd.timer

Note:

 - mask is preferred over disable because disable only removes enablement symlinks; the timer can still be reactivated transiently with systemctl start update-notifier-motd.timer . mask redirects the unit to /dev/null so it cannot be started.
 - This recommendation does not require removing the update-notifier-common package. If the package is also undesired, it may be removed with apt purge update-notifier-common, but that is out of scope for this rule.
 - The companion update-notifier-motd.service rule must also be addressed. Masking only the timer leaves the service available for manual or pam_motd -triggered execution.

Impact:

The dynamic MOTD content (package update counts, security update counts, motd-news lines) will no longer be refreshed on the timer's schedule. Whatever values were last written to /var/lib/update-notifier/updates-available will remain in the MOTD until manually cleared. Sites that want the cached values removed entirely can delete /var/lib/update-notifier/updates-available after masking both units; sites that want to retain the legal banner content without the package-count lines should additionally remove or empty /etc/update-motd.d/90-updates-available (the MOTD fragment that reads the cached file).

See Also

https://workbench.cisecurity.org/benchmarks/27797

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: dcc60ebbab244982ac9e2c67d89a54649dbe77a3bc84532e4938e35a080bf043