# Ensure local login warning banner is configured properly

Necessity: A local login warning banner is a critical administrative and legal control. Its primary purpose is to provide explicit notification to all users attempting to log in locally that the system is for authorized use only and that their activities may be monitored. This eliminates any expectation of privacy and serves as a legal deterrent against unauthorized access. In the event of a security incident, the presence of a clear and unambiguous warning banner can be crucial for legal prosecution, as it demonstrates that the individual was formally warned. Conversely, a missing or poorly worded banner (e.g., 'Welcome!') could weaken an organization's legal position. Auditing and Remediation: The audit script verifies the current configuration by reading the content of the '/etc/issue' file, which is displayed to users before the local login prompt. The remediation script provides a mechanism to enforce the organization's approved banner text by overwriting the contents of this file with a specified message. Recommended State Rationale: The recommended states provide tiered levels of legal robustness. Basic: This state establishes the minimum required warning, informing users of authorized use and monitoring. It is simple and direct. Moderate: This state, often aligned with CIS Benchmarks, provides a more comprehensive legal statement. It explicitly details monitoring, recording, consent, and the potential for sharing evidence with law enforcement, significantly strengthening the organization's legal standing. Strict: This state uses language modeled after stringent government and military standards (e.g., U.S. Department of Defense). It is exceptionally detailed, covering a wide range of monitoring purposes and explicitly stating that the system's security measures are not for the user's personal privacy. This offers the maximum level of legal protection and deterrence.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Authorized use only. All activity may be monitored and reported.']` |
| **Moderate** | `['This system is for the use of authorized users only. Individuals using this computer system without authority, or in excess of their authority, are subject to having all of their activities on this system monitored and recorded by system personnel. In the course of monitoring individuals improperly using this system, or in the course of system maintenance, the activities of authorized users may also be monitored. Anyone using this system expressly consents to such monitoring and is advised that if such monitoring reveals possible evidence of criminal activity, system personnel may provide the evidence of such monitoring to law enforcement officials.']` |
| **Strict** | `['You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. At any time, the USG may inspect and seize data stored on this IS. Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that reads and outputs the exact content of the '/etc/issue' file. The script must not produce any additional text, labels, or formatting; it should only return the raw content of the file.

## Remediation Script Working

Bash script that accepts a single string argument from the command line. The script will overwrite the content of the '/etc/issue' file with this provided string. The script must be owned by root and have permissions of 644 or more restrictive. It must output 'true' upon successful modification and 'false' if the operation fails.

