In the previous part

Configuring the System-wide Crypto Policy

was completed.

1. CIS Benchmark Requirements (Section 1.7)

This section focuses on implementing and properly configuring legal warning banners for system logins and includes the following CIS controls:

• 1.7.1 Ensure message of the day is configured properly (Automated)
• 1.7.2 Ensure local login warning banner is configured properly (Automated)
• 1.7.3 Ensure remote login warning banner is configured properly (Automated)
• 1.7.4 Ensure access to /etc/motd is configured (Automated)
• 1.7.5 Ensure access to /etc/issue is configured (Automated)
• 1.7.6 Ensure access to /etc/issue.net is configured (Automated)

2. Concept & Rationale

Displaying warning messages to users who connect to the system, whether locally or remotely, is a critical legal and security requirement. These banners inform users that the system is monitored and that unauthorized access is subject to legal action.

• /etc/issue: The contents of this file are displayed before the login prompt on local terminals (Console/TTY).
• /etc/issue.net: The contents of this file are shown before login for remote connections such as SSH.
• /etc/motd (Message of the Day): The contents of this file are displayed after successful authentication.
• Preventing Information Leakage: It is critical not to use control characters such as \m, \r, \s, and \v in these files, as they can reveal the exact operating system and kernel version.
• Permissions: To prevent ordinary users or malware from modifying these messages, the files must be owned by root:root (UID 0 and GID 0) and their permissions must be set exactly to 0644.

3. Oracle Database Compatibility Check (RAC, ASM, Grid)

Configuring warning banners is a security measure at the operating system's interactive access layer.

• No Interference: Changing the contents of /etc/issue or /etc/motd does not interfere with Oracle Database operation, Grid Infrastructure services, inter-node communication, or installation and patching processes such as OUI and OPatch.
• Automated Scripts: Oracle tools running in the background (Non-interactive Shells) are not affected by these messages. These changes are completely safe for Oracle RAC and standalone environments.

4. Checking the Current Status (Audit Script)

This script verifies file presence and permissions, and also ensures that sensitive operating system information is not leaked through the banners.

GitHub link:

modules/audit_08_Warning_Banners.sh

If you are not familiar with bash scripts, you can refer to the training material I have published on the site for database administrators.

Bash for Oracle DBAs

#!/bin/bash
# Script: audit_cis_1_7.sh
# Purpose: Audit Warning Banners Content and Permissions

echo -e "\n[+] Auditing CIS 1.7: Command Line Warning Banners..."

FILES=("/etc/motd" "/etc/issue" "/etc/issue.net")

for FILE in "${FILES[@]}"; do
echo "[*] Checking $FILE..."
if [ -e "$FILE" ]; then
# Check permissions and ownership (CIS 1.7.4 - 1.7.6)
STAT=$(stat -c "%a %U %G" "$FILE")
if [ "$STAT" == "644 root root" ]; then
echo " [OK] Permissions and ownership are correct ($STAT)."
else
echo " [!] WARNING: Incorrect permissions/ownership. Current: $STAT. Expected: 644 root root."
fi
fi
done

#!/bin/bash
# Script: audit8.sh
# Purpose: Audit Command Line Warning Banners (CIS 1.7)

echo "=========================================================================="
echo " CIS Requirement: 1.7 Command Line Warning Banners"
echo " - Ensure /etc/motd, /etc/issue, and /etc/issue.net are configured."
echo " - Ensure permissions are 644 and ownership is root:root."
echo " - Ensure no OS or kernel information is leaked."
echo " Oracle Context:"
echo " - Modifying warning banners has NO impact on Oracle Database/RAC."
echo " - Standard banners do not interfere with Oracle automated tasks."
echo "=========================================================================="

FAIL_COUNT=0
FILES=("/etc/motd" "/etc/issue" "/etc/issue.net")
OS_NAME=$(grep '^ID=' /etc/os-release | cut -d= -f2 | sed -e 's/"//g')

echo -e "\n[*] Auditing Warning Banners and Permissions..."

for FILE in "${FILES[@]}"; do
echo "[*] Checking $FILE..."
if [ -e "$FILE" ]; then
# Check permissions and ownership
STAT=$(stat -c "%a %U %G" "$FILE")
if [ "$STAT" == "644 root root" ]; then
echo -e " \e[32m[PASS]\e[0m Permissions and ownership are correct ($STAT)."
else
echo -e " \e[31m[FAIL]\e[0m Incorrect permissions/ownership. Current: $STAT (Expected: 644 root root)."
FAIL_COUNT=$((FAIL_COUNT + 1))
fi

# Check for OS information leaks
if grep -E -i "(\\\v|\\\r|\\\m|\\\s|$OS_NAME)" "$FILE" > /dev/null 2>&1; then
echo -e " \e[31m[FAIL]\e[0m OS or Kernel information leakage detected."
FAIL_COUNT=$((FAIL_COUNT + 1))
else
echo -e " \e[32m[PASS]\e[0m No OS information leaks detected."
fi
else
echo -e " \e[31m[FAIL]\e[0m File $FILE does not exist."
FAIL_COUNT=$((FAIL_COUNT + 1))
fi
done

if [ "$FAIL_COUNT" -eq 0 ]; then
echo -e "\n\e[32m[+] AUDIT RESULT: PASS\e[0m"
else
echo -e "\n\e[31m[-] AUDIT RESULT: FAIL ($FAIL_COUNT issues found)\e[0m"
fi

5. Applying the Configuration (Remediation Bash Script)

The following script applies the standard content consistently and restricts file permissions.

GitHub link:

modules/remediate_08_Warning_Banners.sh

#!/bin/bash
# Script: remediation8.sh
# Purpose: Configure Warning Banners and Permissions (CIS 1.7)

if [ "$EUID" -ne 0 ]; then
echo "Please run as root"
exit 1
fi

echo "=========================================================================="
echo " Applying Remediation for CIS 1.7 (Command Line Warning Banners)"
echo " Oracle Context: Safe to apply. No impact on DB/RAC operations."
echo "=========================================================================="

BANNER_TEXT="Authorized uses only. All activity may be monitored and reported.
Individuals using this computer system without authority, or in excess of their authority, are subject to having all of their activities on this system monitored and recorded by system personnel.
Anyone using this system expressly consents to such monitoring and is advised that if such monitoring reveals possible evidence of criminal activity, system personnel may provide the evidence of such monitoring to law enforcement officials."

FILES=("/etc/motd" "/etc/issue" "/etc/issue.net")

for FILE in "${FILES[@]}"; do
# 1. Update Content
echo "$BANNER_TEXT" > "$FILE"

# 2. Set Ownership and Permissions
chown root:root "$FILE"
chmod 0644 "$FILE"

echo -e " \e[32m[OK]\e[0m Configured content and permissions for $FILE."
done

echo -e "\n\e[32m[+] REMEDIATION APPLIED SUCCESSFULLY\e[0m"

In the next part, we will move on to

Configuring and Managing GNOME Display Manager (GDM)

.