documentation_complete: true


title: 'Enable the SSH login confirmation banner'

description: |-
    This rule verifies that that the SSH login confirmation banner is set 
    correctly.

    The DoD required text is:
    <br /><br />
    <tt>if [ -n "$SSH_CLIENT" ] || [ -n "$SSH_TTY" ]; then<br/>
            while true; do<br/>
                read -p "<br/>
    You are accessing a U.S. Government (USG) Information System (IS) that is provided for
    USG-authorized use only.<br/>
    By using this IS (which includes any device attached to this IS), you consent to the
    following conditions:<br/>
    -The USG routinely intercepts and monitors communications on this IS for purposes
    including, but not limited to, penetration testing, COMSEC monitoring, network
    operations and defense, personnel misconduct (PM), law enforcement (LE), and
    counterintelligence (CI) investigations.<br/>
    -At any time, the USG may inspect and seize data stored on this IS.<br/>
    -Communications using, or data stored on, this IS are not private, are subject to routine
    monitoring, interception, and search, and may be disclosed or used for any USG-
    authorized purpose.<br/>
    -This IS includes security measures (e.g., authentication and access controls) to protect
    USG interests--not for your personal benefit or privacy.<br/>
    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI
    investigative searching or monitoring of the content of privileged communications, or
    work product, related to personal representation or services by attorneys,
    psychotherapists, or clergy, and their assistants. Such communications and work product
    are private and confidential. See User Agreement for details.<br/>
    Do you agree? [y/N] " yn<br/>
                case $yn in
                    [Yy]* ) break ;;<br/>
                    [Nn]* ) exit 1 ;;<br/>
                esac<br/>
            done<br/>
        fi<br/>
    </tt>

rationale: |-
    Display of a standardized and approved use notification before granting
    access to the operating system ensures privacy and security notification
    verbiage used is consistent with applicable federal laws, Executive Orders,
    directives, policies, regulations, standards, and guidance.
    
severity: medium

ocil_clause: 'it does not display the required banner'

ocil: |-
    To check if the system motd banner is compliant,
    run the following command:
    <pre>$ less /etc/profile.d/ssh_confirm.sh</pre>

