<Group id="accounts-banners">
<title>Warning Banners for System Accesses</title>
<description>Each system should expose as little information about
itself as possible.
<br /><br />
System banners, which are typically displayed just before a
login prompt, give out information about the service or the host's
operating system. This might include the distribution name and the
system kernel version, and the particular version of a network
service. This information can assist intruders in gaining access to
the system as it can reveal whether the system is running
vulnerable software. Most network services can be configured to
limit what information is displayed.
<br /><br />
Many organizations implement security policies that require a
system banner provide notice of the system's ownership, provide
warning to unauthorized users, and remind authorized users of their
consent to monitoring.</description>

<Value id="login_banner_text" type="string" operator="equals" interactive="0">
<title>Login Banner Verbiage</title>
<description>Enter an appropriate login banner for your organization. Please note that new lines must
be expressed by the '\n' character and special characters like parentheses and quotation marks must be escaped with '\'.</description>
<!-- <value selector="any_text">.+</value> -->
<value selector="usgcb_default">--[\s\n]+WARNING[\s\n]+--[\s\n]*This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only.[\s\n]+Individuals[\s\n]*using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]*authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]*monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]*system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]*if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]*system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]*enforcement[\s\n]+officials.</value>
<value selector="dod_default">You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U.S.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG-authorized[\s\n]+use[\s\n]+only.[\s\n]*By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\),[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:[\s\n]*-[\s\n]*The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to,[\s\n]+penetration[\s\n]+testing,[\s\n]+COMSEC[\s\n]+monitoring,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\),[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\),[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations.[\s\n]*-[\s\n]*At[\s\n]+any[\s\n]+time,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS.[\s\n]*-[\s\n]*Communications[\s\n]+using,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring,[\s\n]+interception,[\s\n]+and[\s\n]+search,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG-authorized[\s\n]+purpose.[\s\n]*-[\s\n]*This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e.g.,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests[\s\n]+--[\s\n]+not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy.[\s\n]*-[\s\n]*Notwithstanding[\s\n]+the[\s\n]+above,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications,[\s\n]+or[\s\n]+work[\s\n]+product,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys,[\s\n]+psychotherapists,[\s\n]+or[\s\n]+clergy,[\s\n]+and[\s\n]+their[\s\n]+assistants.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details.</value>
<value selector="dod_short">I\'ve[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem\'t.</value>
</Value>

<Rule id="banner_etc_issue" severity="medium">
<title>Modify the System Login Banner</title>
<description>
To configure the system login banner:
<br /><br />
Edit <tt>/etc/issue</tt>. Replace the default text with a message
compliant with the local site policy or a legal disclaimer.

The DoD required text is either:
<br /><br />
<tt>You are accessing a U.S. Government (USG) Information System (IS) that is
provided for USG-authorized use only. By using this IS (which includes any
device attached to this IS), you consent to the following conditions: 
<br />-The USG routinely intercepts and monitors communications on this IS for purposes
including, but not limited to, penetration testing, COMSEC monitoring, network
operations and defense, personnel misconduct (PM), law enforcement (LE), and
counterintelligence (CI) investigations. 
<br />-At any time, the USG may inspect and seize data stored on this IS. 
<br />-Communications using, or data stored on, this IS are not private, are subject 
to routine monitoring, interception, and search, and may be disclosed or used 
for any USG-authorized purpose. 
<br />-This IS includes security measures (e.g., authentication and access controls) 
to protect USG interests -- not for your personal benefit or privacy. 
<br />-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative
searching or monitoring of the content of privileged communications, or work
product, related to personal representation or services by attorneys,
psychotherapists, or clergy, and their assistants. Such communications and work
product are private and confidential. See User Agreement for details.</tt>
<br /><br />
OR:
<br /><br />
<tt>I've read &amp; consent to terms in IS user agreem't.</tt>
</description>
<ocil clause="it does not display the required banner">
To check if the system login banner is compliant,
run the following command:
<pre>$ cat /etc/issue</pre>
</ocil>
<rationale>
An appropriate warning message reinforces policy awareness during the logon
process and facilitates possible legal action against attackers.
</rationale>
<oval id="banner_etc_issue" value="login_banner_text"/>
<ref nist="AC-8(a),AC-8(b),AC-8(c)" disa="48,1384,1385,1386,1387,1388" />
</Rule>

<Group id="gui_login_banner">
<title>Implement a GUI Warning Banner</title>
<description>In the default graphical environment, users logging
directly into the system are greeted with a login screen provided
by the GNOME3 Display Manager (GDM). The warning banner should be
displayed in this graphical environment for these users.
The following sections describe how to configure the GDM login
banner.
</description>

<Rule id="dconf_gnome_banner_enabled" severity="medium">
<title>Enable GNOME3 Login Warning Banner</title>
<description>
To enable displaying a login warning banner in the GNOME
Display Manager's login screen, the <tt>banner-message-enable</tt> setting must be 
set under an appropriate configuration file(s) in the <tt>/etc/dconf/db/gdm.d</tt> directory 
and locked in <tt>/etc/dconf/db/gdm.d/locks</tt> directory to prevent user modification. 
After the settings have been set, run <tt>dconf update</tt>.
To display a banner, this setting must be enabled, and the user must be prevented
from making changes. The banner text must also be set.
</description>
<ocil clause="it is not">
To ensure a login warning banner is enabled, run the following:
<pre>$ grep banner-message-enable /etc/dconf/db/gdm.d/*</pre>
If properly configured, the output should be <tt>true</tt>.
To ensure a login warning banner is locked and cannot be changed by a user, run the following:
<pre>$ grep banner-message-enable /etc/dconf/db/gdm.d/locks/*</pre>
If properly configured, the output should be <tt>/org/gnome/login-screen/banner-message-enable</tt>.
</ocil>
<rationale>
An appropriate warning message reinforces policy awareness during the logon
process and facilitates possible legal action against attackers.
</rationale>
<oval id="dconf_gnome_banner_enabled" />
<ref nist="AC-8(a),AC-8(b),AC-8(c)" disa="48,50" />
</Rule>

<Rule id="dconf_gnome_login_banner_text" severity="medium">
<title>Set the GNOME3 Login Warning Banner Text</title>
<description>
To set the text shown by the GNOME3 Display Manager
in the login screen, the <tt>banner-message-text</tt> setting must be set under an
appropriate configuration file(s) in the <tt>/etc/dconf/db/gdm.d</tt> directory and locked 
in <tt>/etc/dconf/db/gdm.d/locks</tt> directory to prevent user modification. 
After the settings have been set, run <tt>dconf update</tt>.
When entering a warning banner that spans several lines, remember
to begin and end the string with <tt>'</tt> and use <tt>\n</tt> for new lines.
</description>
<ocil clause="it does not">
To ensure the login warning banner text is properly set, run the following:
<pre>$ grep banner-message-text /etc/dconf/db/gdm.d/*</pre>
If properly configured, the proper banner text will appear.
To ensure the login warning banner text is locked and cannot be changed by a user, run the following:
<pre>$ grep banner-message-enable /etc/dconf/db/gdm.d/locks/*</pre>
If properly configured, the output should be <tt>/org/gnome/login-screen/banner-message-text</tt>.
</ocil>
<rationale>
An appropriate warning message reinforces policy awareness during the logon
process and facilitates possible legal action against attackers.
</rationale>
<oval id="dconf_gnome_login_banner_text" value="login_banner_text"/>
<ref nist="AC-8(a),AC-8(b),AC-8(c)" disa="48,1384,1385,1386,1387,1388" />
</Rule>

</Group>

<Rule id="dconf_gnome_disable_user_list">
<title>Disable the GNOME3 Login User List</title>
<description>In the default graphical environment, users logging
directly into the system are greeted with a login screen that displays
all known users. This functionality should be disabled. 
<br /><br />
The <tt>disable-user-list</tt> setting must be 
set under an appropriate configuration file(s) in the <tt>/etc/dconf/db/gdm.d</tt> directory 
and locked in <tt>/etc/dconf/db/gdm.d/locks</tt> directory to prevent user modification. 
After the settings have been set, run <tt>dconf update</tt>.
</description>
<ocil clause="it is not">
To ensure the user list is disabled, run the following command:
<pre>$ grep disable-user-list /etc/dconf/db/gdm.d/*</pre>
The output should be <tt>true</tt>.
To ensure that users cannot enable displaying the user list, run the following:
<pre>$ grep disable-user-list /etc/dconf/db/gdm.d/locks/*</pre>
If properly configured, the output should be <tt>/org/gnome/login-screen/disable-user-list</tt>
</ocil>
<rationale>Leaving the user list enabled is a security risk since it allows anyone
with physical access to the system to quickly enumerate known user accounts
without logging in.</rationale>
<oval id="dconf_gnome_disable_user_list" />
<ref nist="AC-23" />
</Rule>

</Group>

