id: remote-login-warning-banner-configured-check

info:
  name: Ensure Remote Login Warning Banner is Configured Properly
  author: Th3l0newolf
  severity: low
  description: |
    This template checks whether the remote login warning banner is configured
    without exposing system information.
  remediation: |
    Edit `/etc/issue.net` and remove any operating system, kernel, architecture,
    or version information that could disclose system details. Configure the
    banner according to your organization's security policy.
  reference:
    - https://www.cisecurity.org/benchmark/ubuntu_linux
  tags: cis,linux,ubuntu,issue.net,banner,audit
  metadata:
    verified: true

self-contained: true

code:
  - engine:
      - bash
    args:
      - "-c"
      - |
        os_id=$(grep '^ID=' /etc/os-release | cut -d= -f2 | sed 's/"//g')

        if grep -E -i "(\\\v|\\\r|\\\m|\\\s|$os_id)" /etc/issue.net >/dev/null 2>&1; then
          echo "[remote-login-warning-banner-configured-check:Policy-Fail] [/etc/issue.net contains system information] [CIS_FAIL] [low]"
        else
          echo "[remote-login-warning-banner-configured-check:Policy-Pass] [/etc/issue.net is properly configured] [CIS_PASS] [low]"
        fi

    matchers:
      - type: word
        name: policy-pass
        words:
          - "Policy-Pass"

      - type: word
        name: policy-fail
        words:
          - "Policy-Fail"
# digest: 4a0a0047304502202065d10bad394d8529bc1b5346c26671b0fbf5b686bf3ce722361eedb25a8f40022100d64ffaa84730831df0d67eae2bbf88173117bbee798d3bb1f93fd64bb278a428:922c64590222798bb761d5b6d8e72950