# Ensure local login warning banner is configured properly

The necessity of a login warning banner is primarily for legal and deterrence purposes. It establishes a legal boundary, informing all users before they authenticate that the system is private, their activities may be monitored, and unauthorized access has consequences. This is critical for prosecuting intruders, as it negates any claim of ignorance or implied consent for public access. An absent or poorly worded banner can weaken an organization's legal position in the event of a breach. The audit script verifies the existence and content of the banner file, '/etc/issue', which is displayed to users connecting via local terminals. The remediation script configures this banner by writing the desired legal text to '/etc/issue' and securing it with appropriate permissions. The Basic state provides a minimal warning. The Moderate state adds explicit language about consent and penalties, strengthening the legal standing for most corporate environments. The Strict state uses explicit, forceful language common in high-security environments like government or defense, removing any ambiguity about the user's lack of privacy and consent to monitoring, providing the strongest possible legal deterrent and foundation for prosecution.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Authorized uses only. All activity may be monitored and reported.']` |
| **Moderate** | `['This system is for authorized use only. Use of this system constitutes consent to monitoring, recording, and auditing. Unauthorized use is prohibited and may be subject to criminal and civil penalties.']` |
| **Strict** | `['You are accessing a restricted Information System. By using this system, you consent to the following conditions: (1) System activity is monitored, recorded, and subject to audit. (2) Unauthorized use is prohibited and subject to criminal and civil penalties. (3) There is no expectation of privacy except as otherwise provided by applicable privacy laws.']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that reads the content of the file '/etc/issue'. If the file exists, the script must output its raw content and nothing else. If the file does not exist, the script should output an empty string.

## Remediation Script Working

Bash script that accepts a single positional string argument. The script must write this string to the '/etc/issue' file, overwriting any existing content. After writing the content, it must set the file ownership to 'root:root' and permissions to '644'. The script must return 'true' on successful completion and 'false' on any failure.

