Detections
Analytics
1.6.11 Ensure update-notifier-motd.service is not in use
Information
update-notifier-motd.service is a oneshot systemd unit shipped on Ubuntu by the update-notifier-common package. It executes /usr/lib/update-notifier/update-motd-updates-available, which refreshes the dynamic MOTD fragments in /var/lib/update-notifier/ (most visibly updates-available, the "N packages can be updated, M are security updates" lines surfaced by pam_motd ).The same script also drives the motd-news integration via /etc/update-motd.d/50-motd-news, which contacts Ubuntu's motd.ubuntu.com endpoint when ENABLED=1 in /etc/default/motd-news.
Note:
- update-notifier-motd.service is not present on Debian 13 - the update-notifier-common package is Ubuntu-specific. On systems where the unit is not installed, this recommendation passes by default.
- The service is normally triggered by its companion update-notifier-motd.timer ; see also the recommendation covering that timer.
Dynamic MOTD content sourced from the package-management subsystem and from upstream "motd-news" feeds discloses host-specific patch state (package counts, security-update counts, distribution name and version) to anyone who can read the MOTD at the login prompt - including unauthenticated SSH probes when sshd is configured to display the MOTD before the banner. This is information disclosure that aids reconnaissance, conflicts with the Section 1.6 goal of presenting a controlled site-policy login banner, and adds an outbound dependency on third-party infrastructure ( motd.ubuntu.com ) that may not be acceptable in regulated or air-gapped environments.
Stopping and masking the service eliminates both the local information-disclosure surface and the upstream-fetch behaviour without removing the package (which may have other administrative uses).
Solution
- IF - update-notifier-motd.service is installed (Ubuntu), run the following commands to stop and mask the unit:# systemctl stop update-notifier-motd.service
# systemctl mask update-notifier-motd.service
Note:
- mask is preferred over disable because disable only removes enablement symlinks; a transient activation (e.g., via the companion timer, or systemctl start ) will still run the unit. mask redirects the unit to /dev/null so it cannot be started.
- This recommendation does not require removing the update-notifier-common package. If the package is also undesired, it may be removed with apt purge update-notifier-common, but that is out of scope for this rule.
Impact:
The "N packages can be updated, M are security updates" lines and any motd-news content will no longer be refreshed by this service. Administrators relying on those lines for at-a-glance patch status should obtain that information from apt list --upgradable or a dedicated patch-management tool instead.
See Also
Item Details
Audit Name: CIS Ubuntu Linux 26.04 LTS v1.0.0 L1 Server
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2
Plugin: Unix
Control ID: 975508cea508afe166a67e3ec4c6bab0e720e94255a58f010ad4083d5c52e71a