Detections
Analytics

5.1.5 Ensure sshd Banner is configured

Information

The Banner parameter specifies a file whose contents must be sent to the remote user before authentication is permitted. By default, no banner is displayed.

More information about the openSSH server configuration is available in the "Configure SSH Server" section overview.

Banners are used to warn connecting users of the particular site's policy regarding connection. Presenting a warning message prior to the normal user login may assist the prosecution of trespassers on the computer system.

Not having a properly configured SSH banner, or leaving it at the default value, can expose an organization to legal and compliance risks by failing to provide users with necessary access policies or warnings about unauthorized access. It may violate regulations requiring user acknowledgment of system usage rules, reduce security awareness, and leave systems vulnerable to malicious or unintended access.

Solution

Create or edit a *.conf file in the /etc/ssh/sshd_config.d/ directory to set the Banner parameter above any Include and Match entries as follows:

Banner /etc/issue.net

See Also

https://workbench.cisecurity.org/benchmarks/26236

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5

Plugin: Unix

Control ID: 8194cd5bd2a9886dbbfb330f3612dbe0378d594a571d24d4f7b13088569052ec