Set login banner message to /etc/issue in RHEL8 OSPP profile.

[ggbecker]

Description:

• Set login banner message to /etc/issue in RHEL8 OSPP profile. This banner is consumed by rule sshd_enable_warning_banner.

Rationale:

• Unless the banner message is set to /etc/issue, SSH logins will show default message from issue file:

\S
Kernel \r on an \m

[comps]

Is the usgcb banner exactly the same as the one from OSPP v4.2.1 Configuration Annex? ... https://www.niap-ccevs.org/MMO/PP/-442ConfigAnnex-/#logontext

[ggbecker]

Is the usgcb banner exactly the same as the one from OSPP v4.2.1 Configuration Annex? ... https://www.niap-ccevs.org/MMO/PP/-442ConfigAnnex-/#logontext

It's not. The value of login_banner_text should be dod_banners. I'll update that.

[yuumasato]

It's not. The value of login_banner_text should be dod_banners. I'll update that.

dod_banners or dod_default?
dod_banners is a combination of dod_default and dod_short, and allows either one.
The text in linked URL is dod_default.

[ggbecker]

It's not. The value of login_banner_text should be dod_banners. I'll update that.

dod_banners or dod_default?
dod_banners is a combination of dod_default and dod_short, and allows either one.
The text in linked URL is dod_default.

I've updated to use the dod_default which should be the right case, unless requirement changes.

[yuumasato]

I was going to suggest that login_banner_text be interactive, so that one can add its own banner during tailoring with SCAP Workbench.

content/linux_os/guide/system/accounts/accounts-banners/login_banner_text.var

Line 13 in 30e5cd5

interactive: false

But the banner values are actually nasty regexes... so I don't think so.

[ggbecker]

The banner content is supposed to be defined by the organization itself. That means we cannot set a default there as it will be different for each case.

Ensuring that sshd_enable_warning_banner is properly checked and remediated is enough.