2.10.3 Ensure a Custom Message for the Login Screen Is Enabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

An access warning informs the user that the system is reserved for authorized use only, and that the use of the system may be monitored.

Rationale:

An access warning may reduce a casual attacker's tendency to target the system. Access warnings may also aid in the prosecution of an attacker by evincing the attacker's knowledge of the system's private status, acceptable use policy, and authorization requirements.

Impact:

If users are not informed of their responsibilities, unapproved activities may occur. Users that are not approved for access may take the lack of a warning banner as implied consent to access.

Solution

Graphical Method:
Perform the following steps to enable a login banner set to your organization's required text:

Open System Settings

Select Lock Screen

Set Show message when locked to enabled

Select Set

Insert text in the Set a message to appear on the lock screen that matches your organization's required text

Select Done

Terminal Method:
Run the following command to enable a custom login screen message:

$ /usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow LoginwindowText '<custom message>'

example:

$ /usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow LoginwindowText 'Center for Internet Security Test Message'

Profile Method:
Create or edit a configuration profile with the following information:

The PayloadType string is com.apple.loginwindow

The key to include is LoginwindowText

The key must be set to <string><Your organization's required text></string>

See Also

https://workbench.cisecurity.org/files/4159