Login Banners¶
Three files show text before or after login: /etc/issue on the local console, /etc/issue.net over SSH, /etc/motd after login. The benchmark (CIS 1.6.x) wants them to carry a warning and not to reveal what the system is.
Why it matters¶
A warning banner is what makes unauthorized use provably unauthorized. And the default /etc/issue prints the distribution and version (Linux Mint 21.3 Virginia \n \l), which is the first thing an attacker wants to know.
The rules¶
| File | CIS | Contents | Mode |
|---|---|---|---|
/etc/motd |
1.6.1, 1.6.4 | A warning, or empty. No \m \r \s \v escapes, no OS name |
644 root:root |
/etc/issue |
1.6.2, 1.6.5 | Same | 644 root:root |
/etc/issue.net |
1.6.3, 1.6.6 | Same | 644 root:root |
\m, \r, \s, \v expand to the machine type, kernel release, OS name, and version. Remove them along with any literal "Ubuntu", "Mint", or "Debian".
Apply¶
B='Authorized users only. All activity may be monitored and reported.'
echo "$B" | sudo tee /etc/issue /etc/issue.net > /dev/null
echo "$B" | sudo tee /etc/motd > /dev/null
sudo chown root:root /etc/motd /etc/issue /etc/issue.net
sudo chmod 644 /etc/motd /etc/issue /etc/issue.net
If the README supplies banner text, use that instead. /etc/motd is shown by pam_motd after login (Debian CIS 1.6.4), and the same escape and OS-name rules apply to it; Debian also generates a dynamic motd from /etc/update-motd.d/, whose scripts print the kernel version by default. Empty /etc/motd and remove or chmod -x the scripts in /etc/update-motd.d/ if the README wants nothing revealed. For SSH to show issue.net, Banner /etc/issue.net is in the SSH hardening file. On a Debian desktop the same text goes in the GDM banner (Screen Lock and Login Screen).
Verify¶
cat /etc/issue /etc/issue.net /etc/motd
grep -E '\\[mrsv]|Mint|Ubuntu|Debian' /etc/issue /etc/issue.net /etc/motd # nothing
stat -c '%a %U:%G %n' /etc/issue /etc/issue.net /etc/motd
Example¶
/etc/issue reads Linux Mint 21.3 Virginia \n \l and /etc/motd is a 20-line ASCII-art welcome naming the company and the server's role. Replace both with the warning line, set the modes.
Try it¶
- Write the banner, log out, and read it on the console (Ctrl+Alt+F3) and over SSH.
- Grep the three files for the escape sequences.
Build it¶
A banners.sh that writes the three files from a banner.txt and sets the permissions.