Use remote_login_banner_contents variable in rule banner_etc_issue_net

jan-cerny · jan-cerny · commit 23afc386ff3c · 2026-02-12T09:57:17.000+01:00
Use remote_login_banner_contents variable in remediations in rule
banner_etc_issue_net.
Also, add test scenarios to test the ability to parametrize
the rule with a custom banner text.
diff --git a/controls/ccn_ol9.yml b/controls/ccn_ol9.yml
@@ -629,6 +629,7 @@ controls:
           - motd_banner_text=cis_default
           - motd_banner_contents=cis_default
           - remote_login_banner_text=cis_default
+          - remote_login_banner_contents=cis_default
 
     - id: A.11.SEC-OL5
       title: Network Acess to the System is Controlled
diff --git a/controls/cis_al2023.yml b/controls/cis_al2023.yml
@@ -488,6 +488,7 @@ controls:
       rules:
           - banner_etc_issue_net
           - remote_login_banner_text=cis_banners
+          - remote_login_banner_contents=cis_default
 
     - id: 1.7.4
       title: Ensure permissions on /etc/motd are configured (Automated)
diff --git a/controls/cis_sle12.yml b/controls/cis_sle12.yml
@@ -479,6 +479,7 @@ controls:
       rules:
           - banner_etc_issue_net
           - remote_login_banner_text=cis_banners
+          - remote_login_banner_contents=cis_default
 
     - id: 1.8.1.4
       title: Ensure permissions on /etc/motd are configured (Automated)
diff --git a/controls/cis_sle15.yml b/controls/cis_sle15.yml
@@ -477,6 +477,7 @@ controls:
       rules:
           - banner_etc_issue_net
           - remote_login_banner_text=cis_banners
+          - remote_login_banner_contents=cis_default
 
     - id: 1.8.1.4
       title: Ensure permissions on /etc/motd are configured (Automated)
diff --git a/controls/general_sle15.yml b/controls/general_sle15.yml
@@ -490,6 +490,7 @@ controls:
       rules:
           - banner_etc_issue_net
           - remote_login_banner_text=cis_banners
+          - remote_login_banner_contents=cis_default
 
     - id: SLES-15-151050060
       title: Configure access to the Message of the Day Banner
diff --git a/controls/general_slmicro5.yml b/controls/general_slmicro5.yml
@@ -289,6 +289,7 @@ controls:
       rules:
           - banner_etc_issue_net
           - remote_login_banner_text=cis_banners
+          - remote_login_banner_contents=cis_default
 
     - id: SLEM-5-SET-08010400
       title: Verify Ownership and Permissions of/on Message of the Day Banner
diff --git a/controls/std_tencentos4.yml b/controls/std_tencentos4.yml
@@ -134,6 +134,7 @@ controls:
       rules:
           - banner_etc_issue_net
           - remote_login_banner_text=cis_banners
+          - remote_login_banner_contents=cis_default
 
     - id: 1.4.4
       title: Ensure permissions on /etc/motd are configured
diff --git a/controls/stig_ubuntu2204.yml b/controls/stig_ubuntu2204.yml
@@ -498,6 +498,7 @@ controls:
           - medium
       rules:
           - remote_login_banner_text=dod_banners
+          - remote_login_banner_contents=dod_default
           - sshd_enable_warning_banner_net
           - banner_etc_issue_net
       status: automated
diff --git a/controls/stig_ubuntu2404.yml b/controls/stig_ubuntu2404.yml
@@ -441,6 +441,7 @@ controls:
           - medium
       rules:
           - remote_login_banner_text=dod_banners
+          - remote_login_banner_contents=dod_default
           - sshd_enable_warning_banner_net
           - banner_etc_issue_net
       status: automated
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue_net/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue_net/ansible/shared.yml
@@ -3,9 +3,9 @@
 # strategy = unknown
 # complexity = low
 # disruption = medium
-{{{ ansible_instantiate_variables("remote_login_banner_text") }}}
+{{{ ansible_instantiate_variables("remote_login_banner_contents") }}}
 
 - name: "{{{ rule_title }}} - ensure correct banner"
   ansible.builtin.copy:
     dest: /etc/issue.net
-    content: '{{{ ansible_deregexify_banner_etc_issue("remote_login_banner_text") }}}'
+    content: "{{ remote_login_banner_contents | replace('\\n', '\n') }}\n"
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue_net/bash/shared.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue_net/bash/shared.sh
@@ -1,21 +1,4 @@
 # platform = multi_platform_all
 
-{{{ bash_instantiate_variables("remote_login_banner_text") }}}
-
-# Multiple regexes transform the banner regex into a usable banner
-# 0 - Remove anchors around the banner text
-{{{ bash_deregexify_banner_anchors("remote_login_banner_text") }}}
-# 1 - Keep only the first banners if there are multiple
-#    (dod_banners contains the long and short banner)
-{{{ bash_deregexify_multiple_banners("remote_login_banner_text") }}}
-# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
-{{{ bash_deregexify_banner_space("remote_login_banner_text") }}}
-# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n")
-{{{ bash_deregexify_banner_newline("remote_login_banner_text", "\\n") }}}
-# 4 - Remove any leftover backslash. (From any parenthesis in the banner, for example).
-{{{ bash_deregexify_banner_backslash("remote_login_banner_text") }}}
-formatted=$(echo "$remote_login_banner_text" | fold -sw 80)
-
-cat <<EOF >/etc/issue.net
-$formatted
-EOF
+remote_login_banner_contents=$(echo "(bash-populate remote_login_banner_contents)" | sed 's/\\n/\n/g')
+echo "$remote_login_banner_contents" > /etc/issue.net
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue_net/tests/banner_etc_issue_net_mingetty.fail.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue_net/tests/banner_etc_issue_net_mingetty.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+# variables = remote_login_banner_text=^Authorized[\s\n]+users[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$,remote_login_banner_contents=Authorized users only. All activity may be monitored and reported.
+
+echo "System name \s version \s " > /etc/issue.net
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue_net/tests/banner_etc_issue_net_osid.fail.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue_net/tests/banner_etc_issue_net_osid.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+# variables = remote_login_banner_text=^Authorized[\s\n]+users[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$,remote_login_banner_contents=Authorized users only. All activity may be monitored and reported.
+
+echo "This system is rhel." > /etc/issue.net
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue_net/tests/banner_etc_issue_net_recommended.pass.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue_net/tests/banner_etc_issue_net_recommended.pass.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# variables = remote_login_banner_text=^Authorized[\s\n]+users[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$,remote_login_banner_contents=Authorized users only. All activity may be monitored and reported.
+
+# cis_default banner
+echo "Authorized users only. All activity may be monitored and reported." > /etc/issue.net
diff --git a/linux_os/guide/system/accounts/accounts-banners/remote_login_banner_text.var b/linux_os/guide/system/accounts/accounts-banners/remote_login_banner_text.var
@@ -1,17 +1,20 @@
 documentation_complete: true
 
-title: 'Remote Login Banner Verbiage'
+title: Remote Login Banner Verbiage Regular Expression
 
-description: |-
-    Enter an appropriate login banner for your organization. Please note that new lines must
-    be expressed by the '\n' character and special characters like parentheses and quotation marks must be escaped with '\\'.
+description: >-
+    Enter an appropriate login banner regular expression for your organization.
+    Using a regular expression is needed because some profiles (eg. STIG) allow multiple different banners.
+    This regular expression is used only in OVAL checks.
+    In remediations the motd_banner_contents variable is used instead.
+    For information about how to generate banner regular expression for your tailoring files,
+    see: https://complianceascode.readthedocs.io/en/latest/manual/developer/05_tools_and_utilities.html#generating-login-banner-regular-expressions
 
 type: string
 
 operator: equals
 
-interactive: false
-
+interactive: true
 
 options:
 # CIS doesn't enforce any specific content for login banners, but doesn't allow technical information.
diff --git a/products/rhel9/controls/ccn_rhel9.yml b/products/rhel9/controls/ccn_rhel9.yml
@@ -643,6 +643,7 @@ controls:
           - login_banner_text=cis_banners
           - login_banner_contents=cis_default
           - remote_login_banner_text=cis_banners
+          - remote_login_banner_contents=cis_default
 
     - id: A.11.SEC-RHEL5
       title: Network Acess to the System is Controlled
