# Ensure sshd Banner is configured

Necessity: Configuring an SSH banner is a critical administrative and legal control. It displays a warning message to users before they attempt to authenticate, explicitly stating that the system is for authorized use only and may be monitored. This serves as a deterrent to unauthorized users and is often a requirement for legal prosecution in the event of a security breach, as it negates any claims of ignorance about the system's private status. Failure to configure a banner removes this important legal safeguard and may violate compliance requirements.

Auditing and Remediation: The audit script verifies the system's SSH configuration by checking the `/etc/ssh/sshd_config` file for an active `Banner` directive and returns the path to the banner file. The remediation script sets this directive, ensuring that the SSH service presents the specified banner file to connecting users.

Recommended State Rationale: The Basic, Moderate, and Strict levels all recommend configuring the banner to point to `/etc/issue.net`. This is the standard file used for this purpose across many Linux distributions and security benchmarks like CIS. The security effectiveness of this control does not depend on the file path itself, but rather on the content of the banner file. Therefore, the recommendation is consistent across all levels, emphasizing the fundamental need to have an authorized warning banner in place. Organizations should ensure the content of `/etc/issue.net` aligns with their legal and corporate policies.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['/etc/issue.net']` |
| **Moderate** | `['/etc/issue.net']` |
| **Strict** | `['/etc/issue.net']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the `/etc/ssh/sshd_config` file. The script must parse the file to find the value of the `Banner` directive. It should output only the path specified for the banner, or the string 'Not Configured' if the directive is not set or is commented out, with no additional text or labels.

## Remediation Script Working

Bash script that accepts a single positional command-line argument, which is the full path to the banner file (e.g., `/etc/issue.net`). The script must modify the `/etc/ssh/sshd_config` file to set the `Banner` directive to the provided path. It should uncomment the line if it exists but is commented out, or add the line if it does not exist. The script must return `true` if the configuration is successfully applied, and `false` otherwise.

