lowsystemverified ✓rollback-safe

Ensure message of the day is configured properly

motd-configured · RHEL ≥ 8 · 1 impl

Description

The /etc/motd file contains the message of the day that is displayed to users after login. It should not contain OS or kernel version information.

Rationale

Displaying OS version information to users provides attackers with details about the system that could be used to identify vulnerabilities. The banner should contain only authorized use warnings.

Check → Remediate

Checkcommand

if [ ! -f /etc/motd ]; then
  echo "OK: /etc/motd does not exist"
  exit 0
fi
grep -qE '(\\v|\\r|\\m|\\s)' /etc/motd 2>/dev/null
if [ $? -eq 0 ]; then
  echo "FAIL: /etc/motd contains OS information"
  exit 1
fi
echo "OK: /etc/motd properly configured"
exit 0

expected_exit:: 0

Remediatefile_content

path:: /etc/motd
content:: {{ banner_text }}
owner:: root
group:: root
mode:: 0644

Framework references

CIS

rhel9 1.7.1rhel8 1.7.1rhel10 1.7.1

NIST 800-53

AC-8

Live verification

rhel9:check

#banner#motd#login#security