How to Disable the Dynamic MOTD in Ubuntu or Debian
Ubuntu has been using update-motd as a MOTD (Message of the Day) generator for several years. Some of the default messages — such as the number of available security patches — can be helpful, but not everyone likes being greeted by a barrage of text every time they log in to their server. In this article, we’ll explore how to adjust, disable, or replace the dynamic MOTD in Ubuntu.
Before You Begin
If you’d rather work with update-motd than turn it off, detailed documentation for changing its output is available in the man page for update-motd. Essentially, the dynamic MOTD is generated by a collection of executable scripts found in the /etc/update-motd.d/ directory. These scripts can be updated, removed, or reordered, and new scripts can be added.
Disabling the Dynamic MOTD
While Ubuntu does not provide a way to directly uninstall update-motd, it is possible to disable it by adjusting a few PAM options. Two lines, found in both /etc/pam.d/login and /etc/pam.d/sshd, control how update-motd runs on login:
session optional pam_motd.so motd=/run/motd.dynamic session optional pam_motd.so noupdate
Commenting out those lines in both files will prevent the pam_motd.so module from being loaded and will completely disable the dynamic MOTD.
Bonus Section: Enabling a Static MOTD
If you still want a message printed when you log in via SSH, you can configure OpenSSH to display a traditional static MOTD. From the man page for sshd_config:
PrintMotd
Specifies whether sshd should print /etc/motd when a user logs in interactively. (On some systems it is also printed by the shell, /etc/profile, or equivalent.) The default is “yes”.
Ubuntu disables this option by default and incorporates /etc/motd into its dynamic generator, but we can re-enable the option to make /etc/motd work again. Add or uncomment the following line in /etc/ssh/sshd_config and restart the OpenSSH daemon to have OpenSSH print /etc/motd on login:
PrintMotd yes
Well, you don't need to comment pam_motd.so out – you can just change it to `motd=/etc/motd`. See `pam_motd(8)`.
Oops, to correct myself right away, maybe the best way to get a truly static motd is to comment both files out and replace them with this:
`session optional pam_motd.so motd=/etc/motd noupdate`
to get only the contents of `/etc/motd`. "noupdate" seems to prevent the dynamic update process from running, but having *only* "noupdate" gives you also the contents of `/etc/legal` in addition to `/etc/motd`. Specifying the file explicitly prevents the legal text being shown. Of course in corporate environments you probably could update `legal` with your company's policy.
When changing this from the PAM files there's no need to touch `sshd_config` and it should work more consistently regardless of any edge cases.
This is a good point. By keeping pam_motd.so in /etc/pam.d/login and reconfiguring it like you suggest, I believe you'll still get the MOTD for console logins instead of just SSH logins. That is a bit more flexible than the PrintMotd method.
I know this post is only about Ubuntu/Debian, but I also just noticed that Ubuntu's version of pam_motd.so seems to be unique. The RHEL version of pam_motd(8) does not mention the "noupdate" option.
Plus `touch ~/.hushlogin`
This is good advice, especially if you're only trying to disable the MOTD for a single user.