STIGQter: STIG Summary: Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Mar 2021:

The Ubuntu operating system must enable the graphical user logon banner to display the Standard Mandatory DoD Notice and Consent Banner before granting local access to the system via a graphical user logon.

DISA Rule

SV-238197r653766_rule

Vulnerability Number

V-238197

Group Title

SRG-OS-000023-GPOS-00006

Rule Version

UBTU-20-010002

Severity

CAT II

CCI(s)

• CCI-000048 - The information system displays an organization-defined system use notification message or banner before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

Weight

10

Fix Recommendation

Edit the "/etc/gdm3/greeter.dconf-defaults" file.

Look for the "banner-message-enable" parameter under the "[org/gnome/login-screen]" section and uncomment it (remove the leading "#" characters):

Note: The lines are all near the bottom of the file but not adjacent to each other.

[org/gnome/login-screen]

banner-message-enable=true

Update the GDM with the new configuration:

$ sudo dconf update
$ sudo systemctl restart gdm3

Check Contents

Verify the Ubuntu operating system is configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a graphical user logon.

Note: If the system does not have a graphical user interface installed, this requirement is Not Applicable.

Check that the operating banner message for the graphical user logon is enabled with the following command:

$ grep ^banner-message-enable /etc/gdm3/greeter.dconf-defaults

banner-message-enable=true

If the line is commented out or set to "false", this is a finding.

Vulnerability Number

V-238197

Documentable

False

Rule Version

UBTU-20-010002

Severity Override Guidance

Verify the Ubuntu operating system is configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a graphical user logon.

Note: If the system does not have a graphical user interface installed, this requirement is Not Applicable.

Check that the operating banner message for the graphical user logon is enabled with the following command:

$ grep ^banner-message-enable /etc/gdm3/greeter.dconf-defaults

banner-message-enable=true

If the line is commented out or set to "false", this is a finding.

Check Content Reference

M

Target Key

5318

Comments