# Ensure sshd Banner is configured

Necessity: Displaying a security banner before SSH authentication is a crucial security and legal measure. It serves as a warning to unauthorized users that the system is private, for authorized use only, and that all activities may be monitored and logged. This can be critical for legal proceedings against intruders, as it negates any claim of ignorance. Misconfiguration (i.e., not having a banner) removes a layer of legal protection and may inadvertently leak system information that could aid an attacker.

Auditing and Remediation: The audit script inspects the `/etc/ssh/sshd_config` file to determine if the `Banner` directive is properly configured and returns the path to the banner file. The remediation script modifies this same configuration file, setting the `Banner` directive to point to a specified file, and then restarts the SSH service to ensure the change takes effect.

Recommended State Rationale: The recommendation for all hardening levels (Basic, Moderate, and Strict) is to set the banner to `/etc/issue.net`. This is a binary-like setting; it is either correctly configured or it is not. The standard practice across various security benchmarks (like CIS) is to use `/etc/issue.net` for the pre-login banner. The content of this file should be hardened according to organizational policy (e.g., including an explicit warning and avoiding system details), but the configuration to enable the banner feature is consistent across all levels of security.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['/etc/issue.net']` |
| **Moderate** | `['/etc/issue.net']` |
| **Strict** | `['/etc/issue.net']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that reads the `/etc/ssh/sshd_config` file, finds the active `Banner` directive, and returns only the file path value. If the directive is not set or is commented out, the script should return the string 'none'.

## Remediation Script Working

Bash script that accepts a single positional command-line argument representing the full path to the banner file. The script must update the `/etc/ssh/sshd_config` file to set the `Banner` directive to the provided path. If the directive already exists (commented or not), it should be updated; if it does not exist, it should be added. The script must then restart the sshd service to apply the change and return `true` on success or `false` on failure.

