24

I would like to inhibit the generation of the following messages when I ssh into my machine

Expanded Security Maintenance for Applications is not enabled.

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status

For some reason (I do not care to speculate why) these messages are not emitted through the normal motd process, but seem to emanate from update-notifier. There are scripts in the motd directory that appear to generate these messages, but removing them has no effect.

How can I prevent my system from generating these messages at login?

Improve this question
6

3 Answers 3

Reset to default
29

These messages are defined in /usr/lib/update-notifier/apt_check.py with no flags to disable them.

Here's a sed command that will neuter the functions that generate the messages by inserting a return statement as the first line of the message function:

sudo sed -Ezi.orig \
  -e 's/(def _output_esm_service_status.outstream, have_esm_service, service_type.:\n)/\1    return\n/' \
  -e 's/(def _output_esm_package_alert.*?\n.*?\n.:\n)/\1    return\n/' \
  /usr/lib/update-notifier/apt_check.py

A diff of the old and new files looks like this:

$ diff -u /usr/lib/update-notifier/apt_check.py{.orig,}
--- /usr/lib/update-notifier/apt_check.py.orig  2023-02-22 11:33:39.476095290 -0500
+++ /usr/lib/update-notifier/apt_check.py   2023-02-22 11:59:41.396527682 -0500
@@ -160,6 +160,7 @@
 def _output_esm_package_alert(
     outstream, service_type, disabled_pkg_count, is_esm=False
 ):
+    return
     " output the number of upgradable packages if esm service was enabled "
     outstream.write("\n")
     if disabled_pkg_count > 0:
@@ -206,6 +207,7 @@
 
 
 def _output_esm_service_status(outstream, have_esm_service, service_type):
+    return
     if have_esm_service:
         outstream.write(gettext.dgettext("update-notifier",
                                          "Expanded Security Maintenance for "

Test the fix with this command:

$ /usr/lib/update-notifier/apt_check.py --human-readable
1 update can be applied immediately.
To see these additional updates run: apt list --upgradable

Regenerate the cached message file

sudo /usr/lib/update-notifier/update-motd-updates-available --force
Improve this answer
6
  • 3
    This works perfectly.
    – Organic Marble
    Feb 22 at 20:43
  • 3
    Works on Ubuntu 22.10.
    – bvargo
    Feb 26 at 19:02
  • 3
    And Ubuntu 22.04
    – bvargo
    Mar 11 at 18:14
  • 1
    Is there an advantage to using ` /usr/lib/update-notifier/apt_check.py --human-readable ` vs ` sudo run-parts /etc/update-motd.d/ ` to test the patch?
    – bvargo
    Mar 11 at 18:19
  • Interestingly, after apply the fix above, testing with /usr/lib/update-notifier/apt_check.py --human-readable gives the desired output, while testing with sudo run-parts /etc/update-motd.d/ gives the output with ESM junk. Unfortunately I still get the ESM junk on login, which suggests the latter is the better test... :/
    – rednoyz
    Sep 25 at 6:49
15

The easiest way I found to avoid this esm message is to comment out the esm-repo in

/var/lib/ubuntu-advantage/apt-esm/etc/apt/sources.list.d/ubuntu-esm-apps.list

# Written by ubuntu-advantage-tools

#deb https://esm.ubuntu.com/apps/ubuntu jammy-apps-security main
# deb-src https://esm.ubuntu.com/apps/ubuntu jammy-apps-security main

#deb https://esm.ubuntu.com/apps/ubuntu jammy-apps-updates main
# deb-src https://esm.ubuntu.com/apps/ubuntu jammy-apps-updates main
Improve this answer
11
  • 2
    this should be the accepted answer. works perfectly
    – taiyodayo
    Mar 4 at 8:19
  • 2
    @taiyodayo I don't have that repo (or even the /var/lib/ubuntu-advantage/apt-esm directory), so this should not be the accepted answer.
    – Organic Marble
    Mar 31 at 18:06
  • 1
    @taiyodayo I am running 20.04.6. But I have been removing ubuntu advantage's whack-a-mole installs since they started appearing, so maybe that's why I don't have the directories.
    – Organic Marble
    Apr 4 at 14:10
  • 1
    @nobody Ours are semi-fresh installs. More specifically, they're Canonical's official "pre-configured" images for AWS EC2, but "always have been 22.04 rather than upgraded from earlier LTS," if that's what you mean. Maybe that's the crucial difference?
    – Ti Strga
    Apr 11 at 16:22
  • 1
    I reverted my changes in the file I mentioned. And get the esm message back. But I have a simple desktop install no AWS image or something similiar. This could be the difference.
    – nobody
    Apr 11 at 16:27
5

Using e.g. bash:
create .hushlogin and add something like this to an init file like .bashrc_profile

 grep 'immediately' /var/lib/update-notifier/updates-available
 grep 'security' /var/lib/update-notifier/updates-available
 grep 'upgradable' /var/lib/update-notifier/updates-available
 /etc/update-motd.d/98-reboot-required

On login:

2 updates can be applied immediately.
To see these additional updates run: apt list --upgradable
*** System restart required ***

Note that /var/lib/update-notifier/updates-available may be mode 0600 so you'll have to fix that.

Improve this answer
3
  • 1
    This looks like a valid approach so +1. I ended up just disabling update-notifier and wrote my own script that runs at login and shows the number of updates.
    – Organic Marble
    Feb 9 at 17:57
  • 1
    @OrganicMarble: would you please post that script either here or somewhere else?
    – bvargo
    Feb 26 at 19:02
  • @bvargo I posted it in answer to another question, and a smarter user than me pointed out that it was wrong. So now I use the method in the accepted answer here.
    – Organic Marble
    Feb 26 at 19:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .