Ensure a Login Window Banner Exists

How it is checked

Audit method: Shell command

set -- /Library/Security/PolicyBanner.*
[ -e "$1" ] || exit 1
for f in "$@"; do
  p=$(/usr/bin/stat -f %A "$f") || exit 1
  case "$p" in ??4) ;; *) echo "$f mode $p"; exit 0;; esac
done
echo compliant

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Terminal Method: Run the following commands to create or edit the login window text and set the proper permissions: Edit (or create) a PolicyBanner.txt or PolicyBanner.rtf file, in the /Library/Security/ folder, to include the required login window banner text. Perform the following to set permissions on the policy banner file: % /usr/bin/sudo /bin/chmod o+r /Library/Security/PolicyBanner.txt % /usr/bin/sudo /bin/chmod o+r /Library/Security/PolicyBanner.rtf Note: If your organization uses an .rtfd file to set the policy banner, run % /usr/bin/sudo /bin/chmod o+rx /Library/Security/PolicyBanner.rtfd to update the permissions.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target macos --level 2