# Ensure remote login warning banner is configured properly

Necessity: A remote login warning banner is a critical security control that serves as a legal deterrent. It explicitly informs all users attempting to connect remotely (e.g., via SSH) that the system is for authorized use only and that their activities are subject to monitoring. This eliminates claims of ignorance from unauthorized users and is a prerequisite for legal prosecution in many jurisdictions. Misconfiguration or absence of a banner weakens an organization's legal standing in the event of a security breach and fails to meet requirements for compliance frameworks such as NIST, CIS, and PCI-DSS.\n\nAuditing and Remediation: The audit script checks the system's current remote login banner by reading the content of the `/etc/issue.net` file. This file is displayed by default to users connecting via services like telnet or, when configured in `sshd_config`, for SSH connections before authentication. The remediation script writes the organizationally-approved banner text to this file, ensuring the correct permissions and ownership are set to prevent unauthorized modification.\n\nRecommended State Rationale:\n- Basic: Implements a concise warning that establishes the fundamental principles of authorized use and monitoring. This is the minimum acceptable standard for any production system.\n- Moderate: Provides a more explicit and forceful legal statement, clearly outlining user consent to monitoring and the potential for criminal prosecution. This strengthens the organization's legal position against intruders.\n- Strict: Deploys a comprehensive, legally-vetted banner, such as the one mandated by the U.S. Department of Defense. This banner leaves no ambiguity regarding the lack of privacy, the scope of system monitoring, and the potential for data seizure. It provides the maximum legal protection and is recommended for high-security environments, government systems, and organizations subject to stringent regulatory compliance.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `["Authorized uses only. All activity may be monitored and reported."]` |
| **Moderate** | `["This system is for authorized use only. By accessing this system, you consent to monitoring, interception, and disclosure of all activity to law enforcement and other authorized officials. Unauthorized use may result in criminal prosecution."]` |
| **Strict** | `["You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security mechanisms to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."]` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that outputs the raw content of the `/etc/issue.net` file. If the file does not exist or is empty, the script should produce no output. The output must consist solely of the file's content, without any extra text or formatting.

## Remediation Script Working

shell script that accepts the banner text as a single, direct, positional command-line argument. The script must write this exact text to the `/etc/issue.net` file, overwriting any existing content. It must also set the file's ownership to `root:root` and permissions to `0644`. The script must return `true` on success and `false` on failure.

