Ensure Local Login Warning Banner Is Configured Properly
Sets /etc/issue (the pre-login banner shown on local TTYs) to a legal warning that contains no OS/version escape sequences (\s, \m, \r, \v, \l).
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The login banner must state the legal status of access, name the owning organisation, and reference monitoring policy, wording often required to prosecute unauthorised access. Equally important, escape sequences like \s (OS name), \r (kernel release) and \m (architecture) leak detailed system fingerprints to anyone at the prompt, helping an attacker pick targeted exploits. Authorized users get that detail with uname -a after login, so there is no benefit to exposing it pre-auth.
What Pavois checks
Pavois reads /etc/issue and asserts it is non-empty and free of \[smrvlSMRVL] escapes. This is a static file consumed by getty at the local prompt, so reading the file is the effective configuration here, there is no resolved-state command between the file and what the TTY displays.
describe file('/etc/issue') do
its('content') { should match(/\S/) }
its('content') { should_not match(/\\[smrvlSMRVL]/) }
endHow to verify it is applied
Run cat /etc/issue. Expect a clear authorized-use notice and no backslash escapes such as \s/\r/\m. From a console login you should see exactly that text above the login: prompt.
Inspect & investigate
No runtime log; the banner is a display artifact. To audit changes to the file: journalctl _COMM=login shows local logins, and ls -l /etc/issue / stat /etc/issue confirms ownership root:root and mode 0644.
Remediation
pavois harden apply writes /etc/issue with a neutral authorized-access notice, owner root:root and mode 0644. The banner deliberately contains no dynamic escapes, so no system details leak. No reboot or service restart is needed, getty reads the file on the next login.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| content | Authorized access only. All activity on this system is monitored and recorded. Disconnect immediately if you are not an authorized user. |
|---|---|
| group | root |
| mode | 0644 |
| owner | root |
| path | /etc/issue |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Cosmetic and safe, it only changes what is displayed before the local login prompt; no service interruption. Precautions: if you customise the wording, keep it generic and avoid re-adding \ escapes (they reintroduce the OS-fingerprint leak). Some provisioning tools regenerate /etc/issue on boot, which can revert this, make sure no cloud-init/MOTD template overwrites it.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.6.2, 1.7.2 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.