
title: Ensure that the OpenShift MOTD is set

description: |-
  To configure OpenShift's MOTD, create a <b>ConfigMap</b> called <tt>motd</tt>
  in the <tt>openshift</tt> namespace.

  The object should look as follows:

  <pre>
  ---
  apiVersion: v1
  kind: ConfigMap
  metadata:
   name: motd
   namespace: openshift
  data:
    message: "A relevant MOTD"
  </pre>

  Where <tt>message</tt> is a mandatory key.

  The DoD required text is either:
  <br /><br />
  <tt>You are accessing a U.S. Government (USG) Information System (IS) that
  is provided for USG-authorized use only. By using this IS (which includes
  any device attached to this IS), you consent to the following conditions:
  <br />-The USG routinely intercepts and monitors communications on this IS
  for purposes including, but not limited to, penetration testing, COMSEC
  monitoring, network operations and defense, personnel misconduct (PM), law
  enforcement (LE), and counterintelligence (CI) investigations.
  <br />-At any time, the USG may inspect and seize data stored on this IS.
  <br />-Communications using, or data stored on, this IS are not private,
  are subject to routine monitoring, interception, and search, and may be
  disclosed or used for any USG-authorized purpose.
  <br />-This IS includes security measures (e.g., authentication and access
  controls) to protect USG interests -- not for your personal benefit or
  privacy.
  <br />-Notwithstanding the above, using this IS does not constitute consent
  to PM, LE or CI investigative searching or monitoring of the content of
  privileged communications, or work product, related to personal
  representation or services by attorneys, psychotherapists, or clergy, and
  their assistants. Such communications and work product are private and
  confidential. See User Agreement for details.</tt>
  <br /><br />
  OR:
  <br /><br />
  <tt>I've read &amp; consent to terms in IS user agreement.</tt>

rationale: |-
  Display of a standardized and approved use notification before granting
  access to the system ensures privacy and security notification
  verbiage used is consistent with applicable federal laws, Executive Orders,
  directives, policies, regulations, standards, and guidance.
  <br /><br />
  System use notifications are required only for access via login interfaces
  with human users and are not required when such human interfaces do not
  exist.

identifiers:
  cce@ocp4: CCE-84200-5

references:
  nist: AC-8
  srg: SRG-APP-000068-CTR-000120

severity: medium

warnings:
- general: |-
    {{{ openshift_cluster_setting("/api/v1/namespaces/openshift/configmaps/motd") | indent(4) }}}

ocil_clause: 'The OpenShift MOTD is not set'

ocil: |-
  To verify that the MOTD is properly set, do the following:
  <pre>$ oc get configmaps -n openshift motd -ojsonpath='{.data.message}'</pre>
  make sure that the output matches the relevant legal message for
  your organization.

template:
  name: yamlfile_value
  vars:
    ocp_data: "true"
    filepath: /api/v1/namespaces/openshift/configmaps/motd
    yamlpath: ".data.message"
    values:
    - value: ".+"
      operation: "pattern match"
      type: "string"
