Ensure sshd Banner is configured

BajaNivel 1Automatizadafreebsd

Descripción

The Banner parameter specifies a file whose contents must be sent to the remote user before authentication is permitted. By default, no banner is displayed. Banners are used to warn connecting users of the particular site's policy regarding connection. Presenting a warning message prior to the normal user login may assist the prosecution of trespassers on the computer system. Audit: evaluates the effective configuration from `sshd -T` (Match blocks must be reviewed separately).

Cómo se verifica

Método de auditoría: Comando de shell

shell

command -v sshd >/dev/null 2>&1 || exit 1; out=$(sshd -T 2>/dev/null) || exit 1; r=compliant; for p in '^banner[[:blank:]]+/etc/issue\.net$'; do printf '%s\n' "$out" | grep -Eiq -- "$p" || r="not matched: $p"; done; echo "$r"

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Edit the /etc/ssh/sshd_config file to set the parameter above any Include entries as follows: Banner /etc/issue.net

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: freebsdssh
Referencia: CIS FreeBSD 14 Benchmark v1.0.1 - 4.2.5 Ensure sshd Banner is configured

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target freebsd