documentation_complete: true

title: 'Enable SSH Warning Banner'

description: |-
    To enable the warning banner and ensure it is consistent
    across the system, add or correct the following line in <tt>/etc/ssh/sshd_config</tt>:
    <pre>Banner /etc/issue</pre>
    Another section contains information on how to create an
    appropriate system-wide warning banner.

rationale: |-
    The warning message reinforces policy awareness during the login process and
    facilitates possible legal action against attackers.  Alternatively, systems
    whose ownership should not be obvious should ensure usage of a banner that does
    not provide easy attribution.

severity: medium

identifiers:
    cce: 27112-2

references:
    disa: 48
    nist: AC-8(a)
    srg: SRG-OS-000023
    stigid: RHEL-06-000240

ocil: '<sshd-check-macro default="no" option="Banner" value="/etc/issue" />'
