Detections
Analytics

3.25 Host must display a login banner for SSH connections

Information

ESXi facilitates the display of a login message, primarily aimed to deter unauthorized access and inform legitimate users regarding system usage obligations, particularly during SSH connections. The text for this display is defined by a specific parameter, which is advisable to be configured, especially when SSH is active, albeit it's recommended to keep SSH in a stopped state barring troubleshooting scenarios. The parameter governing this behavior is Config.Etc.Issue.

Displaying a login banner serves as a preliminary deterrent to unauthorized users while reinforcing legal and policy compliances for authorized users. It encapsulates a proactive security measure, alongside aligning with several compliance mandates that necessitate the use of login banners.

Solution

- Configure Banner /etc/issue in the SSH configuration and place the approved warning text in the referenced file.
 - Restart SSH only if it is authorized to be running; otherwise leave SSH disabled.

Impact:

There is no functional impact associated with this security control; however, the absence of a login banner might pose a risk in terms of legal protection and compliance adherence, especially during SSH connections where potential misuse could occur. It's prudent to consult with legal advisors to craft a banner text that aligns with organizational and legal requisites.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|CM-7, 800-53|MA-4, CSCv7|5.1

Plugin: Unix

Control ID: 15ed0cee5fc65bfcb4256f94c06e7855e62435bd7f40ed9111fa4a1a3ffd98bf