Detections
Analytics

1.7.1 Ensure /etc/motd is configured

Information

The contents of the /etc/motd file are displayed to users after login and function as a message of the day for authenticated users.

Unix-based systems have typically displayed information about the OS release and patch level upon logging in to the system. This information can be useful to developers who are developing software for a particular OS platform. If mingetty(8) supports the following options, they display operating system information: \m - machine architecture \r - operating system release \s - operating system name \v - operating system version

The /etc/motd file is displayed after a user authenticates. Displaying operating system and patch-level information - for example the \m, \r, \s, and \v escape sequences, or the operating system name - provides detailed system information to attackers attempting to target specific exploits of a system. Where an organization uses the message of the day to convey acceptable-use or monitoring notices, that content should follow local site policy. Authorized users can obtain system information directly (for example by running uname -a ) once logged in, so it does not need to be presented in the banner.

Solution

Edit any /etc/motd or /etc/motd.d/* file to remove the \m, \r, \s, and \v escape sequences and any reference to the OS platform, and ensure the remaining contents follow local site policy.

Run the following command to identify files that still contain system information:

# grep -Psi -- "(\\\v|\\\r|\\\m|\\\s|\b$(grep '^ID=' /etc/os-release | cut -d= -f2 | sed -e 's/"//g')\b)" /etc/motd /etc/motd.d/* 2>/dev/null

- OR -

If a message of the day is not in use, remove the file:

# rm /etc/motd

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-1, 800-53|CM-3, 800-53|CM-6

Plugin: Unix

Control ID: 7979090e00ed17deb0a482e063c4b9229ef5081a08c244925ca3f78aae912d84