Ensure Remote Login Warning Banner Is Configured Properly
Sets /etc/issue.net (the banner offered to remote logins, e.g. SSH via Banner) to a legal warning containing no OS/version escape sequences (\s, \m, \r, \v, \l).
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The remote banner must state the legal status of access, name the owning organisation and reference monitoring, wording often required to prosecute unauthorised remote access. Crucially, /etc/issue.net is exposed over the network before authentication, so any \s/\r/\m escape leaks the OS, kernel and architecture to unauthenticated attackers, handing them a free fingerprint to select exploits. Legitimate users can read these details with uname -a after login.
What Pavois checks
Pavois reads /etc/issue.net and asserts it is non-empty and free of \[smrvlSMRVL] escapes. Note: the banner only reaches SSH clients if sshd -T reports banner /etc/issue.net; this rule checks the file content, while the SSH Banner directive is covered by its own effective-config control. Reading the file is correct here because it is the literal text served.
describe file('/etc/issue.net') do
its('content') { should match(/\S/) }
its('content') { should_not match(/\\[smrvlSMRVL]/) }
endHow to verify it is applied
Run cat /etc/issue.net (no escapes, clear notice). Confirm it is actually served remotely with sshd -T | grep -i banner (expect banner /etc/issue.net), then ssh -o PreferredAuthentications=none user@host should print the banner.
Inspect & investigate
No dedicated log; the banner is a display artifact. Remote login attempts are visible in /var/log/auth.log (Debian/Ubuntu) or journalctl -u ssh / journalctl -u sshd. Ownership/mode: stat /etc/issue.net (expect root:root, 0644).
Remediation
pavois harden apply writes /etc/issue.net with a neutral authorized-access notice, owner root:root, mode 0644, and no dynamic escapes. No reboot needed; if SSH is configured with Banner /etc/issue.net the new text is served on the next connection without an sshd restart.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| content | Authorized access only. All activity on this system is monitored and recorded. Disconnect immediately if you are not an authorized user. |
|---|---|
| group | root |
| mode | 0644 |
| owner | root |
| path | /etc/issue.net |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Safe and cosmetic, it only changes the pre-auth banner text. Precautions: the banner is shown to anyone reaching the SSH port; keep wording generic and free of \ escapes. The file only has effect if sshd_config sets Banner /etc/issue.net, without it the banner is never sent. Watch for provisioning tools that regenerate /etc/issue.net on boot and may revert this.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.6.3, 1.7.3 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.