Detections
Analytics
WN25-SH-000020 - Windows Server 2025 OpenSSH must display the Standard Mandatory DoW Notice and Consent Banner before granting remote access to the system via an OpenSSH logon.
Information
The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious must ensure usage of a banner that does not provide easy attribution.Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00089
Solution
To configure the system, add or modify the following line in the '$env:ProgramData/ssh/sshd_config' file.An example configuration line is:
Banner C:\ProgramData\ssh\Banner.txt
Restart the OpenSSH service for the settings to take effect.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2025_V1R3_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows Server 2025 STIG v1r3
Category: ACCESS CONTROL
References: 800-53|AC-8a., 800-53|AC-8c.1., 800-53|AC-8c.2., 800-53|AC-8c.3., CAT|II, CCI|CCI-000048, CCI|CCI-001384, CCI|CCI-001385, CCI|CCI-001386, CCI|CCI-001387, CCI|CCI-001388, Rule-ID|SV-285314r1256731_rule, STIG-ID|WN25-SH-000020, Vuln-ID|V-285314
Plugin: Windows
Control ID: ddd5f4cc3b333584bb69e923a5b60b16b9523232cd57c1cfe4cd443b89f3dcc3