Safely inspect or suppress Ubuntu Pro/ESM login MOTD notices while retaining package update counts

README.md

Ubuntu Pro/ESM MOTD notice manager

This script suppresses the Ubuntu Pro/Expanded Security Maintenance promotional notices printed during login. It does not disable Ubuntu Pro services, uninstall packages, change APT sources, or hide ordinary package and security update counts.

It uses Ubuntu's marker file:

/var/lib/update-notifier/hide-esm-in-motd

After changing the marker, it forces update-notifier to rebuild its cached update text and regenerates /run/motd.dynamic. This avoids leaving an older Pro/ESM message visible until the cache refreshes naturally.

Review first (recommended)

GIST_RAW="https://gist.githubusercontent.com/lbussy/d41d1ebc9a6e4930be955ea1e66bf784/raw/ubuntu-esm-motd.sh"
curl -fsSL "$GIST_RAW" -o /tmp/ubuntu-esm-motd.sh
less /tmp/ubuntu-esm-motd.sh
sh /tmp/ubuntu-esm-motd.sh status
sudo sh /tmp/ubuntu-esm-motd.sh disable
rm /tmp/ubuntu-esm-motd.sh

Running the script without an argument is the same as status and makes no changes. Only disable and enable require root privileges.

Direct curl-through-shell use

Review-first use is safer because a mutable remote script can change. If you trust this Gist and deliberately accept that risk:

curl -fsSL "https://gist.githubusercontent.com/lbussy/d41d1ebc9a6e4930be955ea1e66bf784/raw/ubuntu-esm-motd.sh" | sudo sh -s -- disable

Inspect without making changes:

curl -fsSL "https://gist.githubusercontent.com/lbussy/d41d1ebc9a6e4930be955ea1e66bf784/raw/ubuntu-esm-motd.sh" | sh -s -- status

Restore the Pro/ESM login notices:

curl -fsSL "https://gist.githubusercontent.com/lbussy/d41d1ebc9a6e4930be955ea1e66bf784/raw/ubuntu-esm-motd.sh" | sudo sh -s -- enable

Verify

grep -Ei 'Expanded Security Maintenance|ESM Apps|ubuntu\.com/esm|pro status' \
  /run/motd.dynamic || echo 'No Pro/ESM notices found'

The next interactive SSH login should retain normal update counts but omit the Ubuntu Pro/ESM promotional paragraphs.

Compatibility

• Ubuntu systems using update-notifier and /etc/update-motd.d
• POSIX /bin/sh; no Bash-specific features required
• Idempotent: repeated disable or enable calls are safe

ubuntu-esm-motd.sh

#!/bin/sh
# Manage Ubuntu Pro/ESM notices in the login MOTD without disabling
# ordinary package-update notices.

set -eu

MARKER=/var/lib/update-notifier/hide-esm-in-motd
UPDATER=/usr/lib/update-notifier/update-motd-updates-available
MOTD_DIR=/etc/update-motd.d
MOTD_CACHE=/run/motd.dynamic

usage() {
    cat <<'EOF'
Usage: ubuntu-esm-motd.sh [status|disable|enable]

  status   Inspect the current setting (default; makes no changes)
  disable  Suppress Ubuntu Pro/ESM login notices
  enable   Restore Ubuntu Pro/ESM login notices

Ordinary package-update notices remain enabled.
EOF
}

die() {
    printf 'Error: %s\n' "$*" >&2
    exit 1
}

is_ubuntu() {
    [ -r /etc/os-release ] || return 1
    # shellcheck disable=SC1091
    . /etc/os-release
    [ "${ID:-}" = ubuntu ]
}

require_root() {
    [ "$(id -u)" -eq 0 ] || die "this action must run as root (try sudo)"
}

refresh_motd() {
    if [ -x "$UPDATER" ]; then
        "$UPDATER" --force
    fi

    if [ -d "$MOTD_DIR" ] && command -v run-parts >/dev/null 2>&1; then
        run-parts "$MOTD_DIR" >"$MOTD_CACHE"
    fi
}

status() {
    if [ -e "$MARKER" ]; then
        printf 'Ubuntu Pro/ESM login notices: suppressed\n'
        printf 'Suppression marker: %s\n' "$MARKER"
    else
        printf 'Ubuntu Pro/ESM login notices: enabled\n'
        printf 'Suppression marker absent: %s\n' "$MARKER"
    fi

    if [ -r "$MOTD_CACHE" ]; then
        if grep -Eiq 'Expanded Security Maintenance|ESM Apps|ubuntu\.com/esm|pro status' "$MOTD_CACHE"; then
            printf 'Current MOTD cache: contains Pro/ESM notices\n'
        else
            printf 'Current MOTD cache: no Pro/ESM notices found\n'
        fi
    else
        printf 'Current MOTD cache: unavailable at %s\n' "$MOTD_CACHE"
    fi
}

is_ubuntu || die "this script supports Ubuntu only"

action=${1:-status}
[ "$#" -le 1 ] || { usage >&2; exit 2; }

case "$action" in
    status)
        status
        ;;
    disable)
        require_root
        install -o root -g root -m 0644 /dev/null "$MARKER"
        refresh_motd
        status
        ;;
    enable)
        require_root
        rm -f "$MARKER"
        refresh_motd
        status
        ;;
    -h|--help|help)
        usage
        ;;
    *)
        usage >&2
        exit 2
        ;;
esac