Protect the login banner files from modification

Description

/etc/issue, /etc/issue.net and /etc/motd are shown to users before or after login. They must be owned by root and writable only by root.

Rationale

A writable banner lets an attacker remove the legal warning, or display fake instructions that trick users into running commands or giving out credentials.

Impact

None known. These are the Debian defaults.

Setting

Audit

Run stat -c '%n %U:%G %a' /etc/issue /etc/issue.net /etc/motd. Each file must be root:root with mode 644 or stricter.

Automated: every check must pass. Scanners report each check by its id.

issue

path: /etc/issue
owner: root
group: root
mode: '0644'

issue-net

path: /etc/issue.net
owner: root
group: root
mode: '0644'

motd

path: /etc/motd
owner: root
group: root
mode: '0644'

Remediation

Run chown root:root /etc/issue /etc/issue.net /etc/motd and chmod 644 /etc/issue /etc/issue.net /etc/motd.

issue

Generated from check issue: the engine writes the fix for every output, it sets the expected value and the check runs again after.

issue-net

Generated from check issue-net: the engine writes the fix for every output, it sets the expected value and the check runs again after.

motd

Generated from check motd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• issue(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R50) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle