Description
The Banner option of the OpenSSH server names a file whose content is sent to the client
before authentication. This control requires it to point to {{ ssh_banner }}, the network
login warning whose content is covered by CB-DEB-AUTH-001.
Rationale
A warning shown before login states that access is reserved to authorized users and may be monitored. In many jurisdictions it supports legal action against intruders and the use of monitoring records.
Impact
The banner is printed by interactive clients before the password or key prompt. Some old automation tools treat any pre-authentication output as an error.
Applies when
Detected: when: OpenSSH server is installed A scanner reports the control not applicable when one is false.
Setting
| Location | /etc/ssh/sshd_config.d/00-cirsec.conf |
| Default | none |
| Recommended | {{ ssh_banner }} |
Parameters
| Parameter | Core | Server | Server hardened | Desktop | Desktop hardened | Bounds |
|---|---|---|---|---|---|---|
ssh_bannerstring. File sent by the SSH server before authentication. | /etc/issue.net | /etc/issue.net | /etc/issue.net | /etc/issue.net | /etc/issue.net |
The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.
Audit
Run sshd -T | grep '^banner '. It must print banner {{ ssh_banner }}, and that file must
contain the organization's warning text.
Automated: every check must pass. Scanners report each check by its id.
banner
Banner.
key: banner
value: '{{ ssh_banner }}'
Remediation
Add Banner {{ ssh_banner }} to /etc/ssh/sshd_config.d/00-cirsec.conf, check with
sshd -t, then run systemctl reload ssh. Write the warning text in the file (see
CB-DEB-AUTH-001).
| Restart | service: ssh |
| Disruption | none |
| Lockout risk | yes: can cut off administrative access. Off by default in generated scripts and playbooks, opt in through a tailoring file. |
Rollback
Remove the line and run systemctl reload ssh.
banner
Generated from check banner: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- sshd_config(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
Mappings
| Framework | ID | Relation |
|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | AC-8 | partial |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Related controls
- related
CB-DEB-AUTH-001Show a legal warning before login, without system details
People and lifecycle
| Authors |
|
| Verified | 2026-10-18 by Sn0wAlice on 12, Proxmox VM 921, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64. Generated fix sets Banner /etc/issue.net; SSH by key still accepted after the fix and after reboot. |
| Verified | 2026-10-18 by Sn0wAlice on 13, Proxmox VM 931, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64. Generated fix sets Banner /etc/issue.net; SSH by key still accepted after the fix and after reboot. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-18, 2026-10-18 |
| Translations | fr |
