CB-DEB-AUTH-001: Show a legal warning before login, without system details (v0.1.0)

Description

/etc/issue is printed before local console logins and /etc/issue.net before network logins of services that use it. On Debian both contain the distribution name and version, and /etc/issue also uses escape sequences (\s, \r, \v, \m) that print the kernel name, release, version and architecture.

The SSH server only shows a banner when its Banner option is set; that is covered with the other SSH settings.

Rationale

A banner that states access is restricted and monitored supports legal action against intruders in many jurisdictions. Version details in the banner help an attacker pick exploits without any interaction with the system.

Impact

None known. Administrators who want the version still get it from uname -a after login.

Setting

Location	/etc/issue, /etc/issue.net
Default	Distribution name and version
Recommended	{{ banner_text }}

Parameters

Parameter	Core	Server	Server hardened	Desktop	Desktop hardened	Bounds
`banner_text`string. Text of the legal warning. It must not name the operating system or its version.	`Authorized use only. Activity on this system is monitored and recorded.`	`Authorized use only. Activity on this system is monitored and recorded.`	`Authorized use only. Activity on this system is monitored and recorded.`	`Authorized use only. Activity on this system is monitored and recorded.`	`Authorized use only. Activity on this system is monitored and recorded.`

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

Read /etc/issue and /etc/issue.net. Both must contain a warning and no OS name or version.
Neither file may contain the escape sequences \m, \r, \s or \v.

Automated: every check must pass. Scanners report each check by its id.

`issue-present`

/etc/issue has some text.

engine: File content

path: /etc/issue
pattern: \w

`issue-no-os`

/etc/issue does not reveal the system.

engine: File content

path: /etc/issue
pattern: \\[mrsv]|Debian|GNU/Linux
expect: no_match

`issue-net-present`

/etc/issue.net has some text.

engine: File content

path: /etc/issue.net
pattern: \w

`issue-net-no-os`

/etc/issue.net does not reveal the system.

engine: File content

path: /etc/issue.net
pattern: \\[mrsv]|Debian|GNU/Linux
expect: no_match

Remediation

Replace the content of /etc/issue and /etc/issue.net with the warning text: "{{ banner_text }}"

Restart	none
Disruption	none

Rollback

Restore the files from the backup, or write Debian GNU/Linux \n \l back to /etc/issue.

`write`

engine: POSIX shell

for f in /etc/issue /etc/issue.net; do
  cb_backup "$f"
  printf '%s\n' "$CB_BANNER_TEXT" >"$f"
  chmod 644 "$f"
done

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

issue(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
agetty(8), Debian manual pages (issue file escapes) Debian, vendor-doc, accessed 2026-10-18

Mappings

Framework	ID	Relation
NIST SP 800-53 Rev. 55.1.1	`AC-8`	partial

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Taxonomy	ID
MITRE ATT&CK	`T1082`

People and lifecycle

Authors	Alice@Sn0wAlice
Verified	2026-10-18 by Sn0wAlice on 12, Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64. Generated check, fix and check again for profiles core and server-hardened; state kept after reboot.
Verified	2026-10-18 by Sn0wAlice on 13, Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64. Generated check, fix and check again for profiles core and server-hardened; state kept after reboot.
Introduced in	v0.1.0
Created, updated	2026-10-18, 2026-10-18
Translations	`fr`