InfoOS hardeningBLWK-BANN-001

No custom legal warning banner is set (/etc/‹file›)

What this means

/etc/‹file› still contains the distro's default auto-generated content (OS name and getty templating codes), not a deliberate legal warning. In some jurisdictions, a clear “unauthorized access is prohibited” banner is what establishes that someone connecting without authorization was actually warned — the default OS-identification banner doesn't do that, and also unnecessarily advertises the exact OS version to anyone who connects. Scoped to the server profile: a login banner's function is legal, not technical — it establishes that access was unauthorized, which matters for a multi-user remote system. On a personal desktop it protects nothing, and /etc/issue.net is read only by sshd, so on a host that doesn't run sshd it is inert text in a file nobody opens.

How to fix it

Replace the contents of /etc/issue (local login) and /etc/issue.net (remote login) with a warning banner, not OS version info.

Check it yourself

Run a scan and look for BLWK-BANN-001 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads banners and reports this check when:

is_default == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 1.7.1

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001