Ensure Message Of The Day Is Configured Properly
Sets /etc/motd (the message-of-the-day shown after a successful login) to an authorized-use notice containing no OS/version escape sequences (\s, \m, \r, \v, \l).
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The message of the day should restate the legal status of access and the monitoring policy for users who have just logged in. It must not contain \s/\r/\m style escapes that reveal the OS, kernel release and architecture, even post-login this needlessly broadcasts system details that aid lateral-movement targeting. Authorized users can obtain those details deliberately with uname -a.
What Pavois checks
Pavois reads /etc/motd and asserts it is non-empty and free of \[smrvlSMRVL] escapes. On modern systems pam_motd may also assemble dynamic content from /etc/update-motd.d/, but the static /etc/motd is the file this rule governs; reading it directly reflects what is shown after login.
describe file('/etc/motd') do
its('content') { should match(/\S/) }
its('content') { should_not match(/\\[smrvlSMRVL]/) }
endHow to verify it is applied
Run cat /etc/motd (clear notice, no \ escapes). Log in interactively and confirm the same text appears after authentication; on Ubuntu also check /etc/update-motd.d/ is not re-injecting OS details.
Inspect & investigate
No runtime log; MOTD is a display artifact rendered by pam_motd. Login events appear in /var/log/auth.log or journalctl _COMM=login / journalctl -u ssh. Ownership/mode: stat /etc/motd (expect root:root, 0644).
Remediation
pavois harden apply writes /etc/motd with a neutral authorized-access notice, owner root:root, mode 0644, and no dynamic escapes. No reboot or service restart is needed, pam_motd renders the new content at the next login.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| content | Authorized access only. All activity on this system is monitored and recorded. Disconnect immediately if you are not an authorized user. |
|---|---|
| group | root |
| mode | 0644 |
| owner | root |
| path | /etc/motd |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Cosmetic and safe, only the post-login message changes; no service interruption. Precautions: on Ubuntu the dynamic /etc/update-motd.d/ scripts can append OS/version info and override this intent; disable or sanitise those scripts if strict compliance is required. Keep custom wording free of \ escapes to avoid reintroducing the fingerprint leak.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.6.1, 1.7.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.