Show a legal warning before login, without system details

Description

/etc/issue is printed before local console logins and /etc/issue.net before network logins of services that use it. On Ubuntu both contain the distribution name and full version (Ubuntu 24.04.5 LTS). The escape sequences \s, \r, \v and \m, if added, print the kernel name, release, version and architecture.

The SSH server only shows a banner when its Banner option is set; that is covered with the other SSH settings.

Rationale

A banner that states access is restricted and monitored supports legal action against intruders in many jurisdictions. Version details in the banner help an attacker pick exploits without any interaction with the system.

Impact

None known. Administrators who want the version still get it from uname -a after login.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Read /etc/issue and /etc/issue.net. Both must contain a warning and no OS name or version.
2. Neither file may contain the escape sequences \m, \r, \s or \v.

Automated: every check must pass. Scanners report each check by its id.

issue-present

/etc/issue has some text.

path: /etc/issue
pattern: \w

issue-no-os

/etc/issue does not reveal the system.

path: /etc/issue
pattern: \\[mrsv]|Ubuntu|Debian|GNU/Linux
expect: no_match

issue-net-present

/etc/issue.net has some text.

path: /etc/issue.net
pattern: \w

issue-net-no-os

/etc/issue.net does not reveal the system.

path: /etc/issue.net
pattern: \\[mrsv]|Ubuntu|Debian|GNU/Linux
expect: no_match

Remediation

Replace the content of /etc/issue and /etc/issue.net with the warning text: "{{ banner_text }}"

Rollback

Restore the files from the backup, or write Ubuntu <version> LTS \n \l back to /etc/issue.

write

for f in /etc/issue /etc/issue.net; do
  cb_backup "$f"
  printf '%s\n' "$CB_BANNER_TEXT" >"$f"
  chmod 644 "$f"
done

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• issue(5), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• agetty(8), Ubuntu manual pages (issue file escapes) Canonical, vendor-doc, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle