STIGQter: STIG Summary: SLES 12 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The SUSE operating system must display a banner before granting local or remote access to the system via a graphical user logon.

DISA Rule

SV-217105r646678_rule

Vulnerability Number

V-217105

Group Title

SRG-OS-000228-GPOS-00088

Rule Version

SLES-12-010040

Severity

CAT II

CCI(s)

• CCI-001384 - The information system, for publicly accessible systems, displays system use information organization-defined conditions before granting further access.
• CCI-001385 - The information system, for publicly accessible systems, displays references, if any, to monitoring that are consistent with privacy accommodations for such systems that generally prohibit those activities.
• CCI-001386 - The information system, for publicly accessible systems, displays references, if any, to recording that are consistent with privacy accommodations for such systems that generally prohibit those activities.
• CCI-001387 - The information system, for publicly accessible systems, displays references, if any, to auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities.
• CCI-001388 - The information system, for publicly accessible systems, includes a description of the authorized uses of the system.

Weight

10

Fix Recommendation

Note: If the system does not have a graphical user interface installed, this requirement is Not Applicable.

Configure the SUSE operating system to display a banner before local or remote access to the system via a graphical user logon.

Create a database that will contain the system wide graphical user logon settings (if it does not already exist) with the following command:

> sudo touch /etc/dconf/db/gdm.d/01-banner-message

Add the following line to the "[org/gnome/login-screen]" section of the "/etc/dconf/db/gdm.d/01-banner-message" file:

[org/gnome/login-screen]
banner-message-enable=true

Update the system databases:

> sudo dconf update

Users must log out and back in again before the system-wide settings take effect.

Check Contents

Note: If the system does not have a graphical user interface installed, this requirement is Not Applicable.

Verify the SUSE operating system to display a banner before local or remote access to the system via a graphical user logon.

Check that the SUSE operating system displays a banner at the logon screen by performing the following command:

> grep banner-message-enable /etc/dconf/db/gdm.d/*
banner-message-enable=true

> cat /etc/dconf/profile/gdm
user-db:user
system-db:gdm
file-db:/usr/share/gdm/greeter-dconf-defaults

If "banner-message-enable" is set to "false" or is missing completely, this is a finding.

Vulnerability Number

V-217105

Documentable

False

Rule Version

SLES-12-010040

Severity Override Guidance

Note: If the system does not have a graphical user interface installed, this requirement is Not Applicable.

Verify the SUSE operating system to display a banner before local or remote access to the system via a graphical user logon.

Check that the SUSE operating system displays a banner at the logon screen by performing the following command:

> grep banner-message-enable /etc/dconf/db/gdm.d/*
banner-message-enable=true

> cat /etc/dconf/profile/gdm
user-db:user
system-db:gdm
file-db:/usr/share/gdm/greeter-dconf-defaults

If "banner-message-enable" is set to "false" or is missing completely, this is a finding.

Check Content Reference

M

Target Key

4033

Comments