Ensure a Login Window Banner Exists

MediumLevel 2Automatedmacos

Description

A Login window banner warning informs the user that the system is reserved for authorized use only. It enforces an acknowledgment by the user that they have been informed of the use policy in the banner if required. The system recognizes either the .txt and the .rtf formats. Audit: A /Library/Security/PolicyBanner.* file must exist and its mode must have 4 as the third digit.

How it is checked

Audit method: Shell command

shell

set -- /Library/Security/PolicyBanner.*
[ -e "$1" ] || exit 1
for f in "$@"; do
  p=$(/usr/bin/stat -f %A "$f") || exit 1
  case "$p" in ??4) ;; *) echo "$f mode $p"; exit 0;; esac
done
echo compliant

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Terminal: sudo /bin/chmod o+r /Library/Security/PolicyBanner.txt ; sudo /bin/chmod o+r /Library/Security/PolicyBanner.rtf.

Properties

Operating systems: macos-15
Tags: macossystem-access
Reference: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 5.8 Ensure a Login Window Banner Exists

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos --level 2