documentation_complete: true

prodtype: rhel7,fedora

title: 'Set the GNOME3 Login Warning Banner Text'

description: |-
    In the default graphical environment, configuring the login warning banner text
    in the GNOME Display Manager's login screen can be configured on the login
    screen by setting <tt>banner-message-text</tt> to <tt>string '<i>APPROVED_BANNER</i>'</tt>
    where <i>APPROVED_BANNER</i> is the approved banner for your environment.
    <br /><br />
    To enable, add or edit <tt>banner-message-text</tt> to
    <tt>/etc/dconf/db/gdm.d/00-security-settings</tt>. For example:
    <pre>[org/gnome/login-screen]
    banner-message-text=string '<i>APPROVED_BANNER</i>'</pre>
    Once the setting has been added, add a lock to
    <tt>/etc/dconf/db/gdm.d/locks/00-security-settings-lock</tt> to prevent user modification.
    For example:
    <pre>/org/gnome/login-screen/banner-message-text</pre>
    After the settings have been set, run <tt>dconf update</tt>.
    When entering a warning banner that spans several lines, remember
    to begin and end the string with <tt>'</tt> and use <tt>\n</tt> for new lines.

rationale: |-
    An appropriate warning message reinforces policy awareness during the logon
    process and facilitates possible legal action against attackers.

severity: medium

identifiers:
    cce@rhel7: 26892-0

references:
    cis: 1.7.2
    cui: 3.1.9
    disa: 48
    nist: AC-8(a),AC-8(b),AC-8(c)
    ospp@rhel7: FMT_MOF_EXT.1
    srg: SRG-OS-000023-GPOS-00006,SRG-OS-000024-GPOS-00007,SRG-OS-000228-GPOS-00088
    stigid@rhel7: "010040"

ocil_clause: 'it does not'

ocil: |-
    To ensure the login warning banner text is properly set, run the following:
    <pre>$ grep banner-message-text /etc/dconf/db/gdm.d/*</pre>
    If properly configured, the proper banner text will appear.
    To ensure the login warning banner text is locked and cannot be changed by a user, run the following:
    <pre>$ grep banner-message-text /etc/dconf/db/gdm.d/locks/*</pre>
    If properly configured, the output should be <tt>/org/gnome/login-screen/banner-message-text</tt>.
