Use login_banner_contents variable in rule banner_etc_issue

jan-cerny · jan-cerny · commit 36fd64709156 · 2026-02-11T17:19:19.000+01:00
Use login_banner_contents variable in remediations in rule
banner_etc_issue.
Also, add test scenarios to test the ability to parametrize
the rule with a custom banner text.
diff --git a/controls/ccn_ol9.yml b/controls/ccn_ol9.yml
@@ -625,6 +625,7 @@ controls:
           - dconf_gnome_login_banner_text
           - sshd_enable_warning_banner_net
           - login_banner_text=cis_default
+          - login_banner_contents=cis_default
           - motd_banner_text=cis_default
           - remote_login_banner_text=cis_default
 
diff --git a/controls/cis_al2023.yml b/controls/cis_al2023.yml
@@ -477,6 +477,7 @@ controls:
       rules:
           - banner_etc_issue
           - login_banner_text=cis_banners
+          - login_banner_contents=cis_default
 
     - id: 1.7.3
       title: Ensure remote login warning banner is configured properly (Automated)
diff --git a/controls/cis_sle12.yml b/controls/cis_sle12.yml
@@ -467,6 +467,7 @@ controls:
       rules:
           - banner_etc_issue
           - login_banner_text=cis_banners
+          - login_banner_contents=cis_default
 
     - id: 1.8.1.3
       title: Ensure remote login warning banner is configured properly (Automated)
diff --git a/controls/cis_sle15.yml b/controls/cis_sle15.yml
@@ -465,6 +465,7 @@ controls:
       rules:
           - banner_etc_issue
           - login_banner_text=cis_banners
+          - login_banner_contents=cis_default
 
     - id: 1.8.1.3
       title: Ensure remote login warning banner is configured properly (Automated)
diff --git a/controls/general_sle15.yml b/controls/general_sle15.yml
@@ -479,6 +479,7 @@ controls:
       rules:
           - banner_etc_issue
           - login_banner_text=cis_banners
+          - login_banner_contents=cis_default
 
     - id: SLES-15-151050045
       title: Modify the System Login Banner for Remote Connections
diff --git a/controls/general_slmicro5.yml b/controls/general_slmicro5.yml
@@ -278,6 +278,7 @@ controls:
       rules:
           - banner_etc_issue
           - login_banner_text=cis_banners
+          - login_banner_contents=cis_default
 
     - id: SLEM-5-SET-08010300
       title: Modify the System Login Banner for Remote Connections
@@ -1021,6 +1022,7 @@ controls:
       rules:
           - banner_etc_issue
           - login_banner_text=dod_banners
+          - login_banner_contents=dod_default
           - sshd_enable_warning_banner
       status: automated
 
diff --git a/controls/nist_rhcos4.yml b/controls/nist_rhcos4.yml
@@ -1228,6 +1228,7 @@ controls:
       rules:
           - banner_etc_issue
           - login_banner_text=dod_banners
+          - login_banner_contents=dod_default
       description: "The information system:\n a. Displays to users [Assignment: organization-defined\
           \ system use notification message or banner] before granting access to the system that provides\
           \ privacy and security notices consistent with applicable federal laws, Executive Orders, directives,\
diff --git a/controls/srg_gpos.yml b/controls/srg_gpos.yml
@@ -26,5 +26,6 @@ controls:
           - var_accounts_authorized_local_users_regex=rhel9
           - var_account_disable_post_pw_expiration=35
           - login_banner_text=dod_banners
+          - login_banner_contents=dod_default
           - var_authselect_profile=sssd
           - var_auditd_name_format=stig
diff --git a/controls/std_kylinserver10.yml b/controls/std_kylinserver10.yml
@@ -119,6 +119,7 @@ controls:
       rules:
           - banner_etc_issue
           - login_banner_text=cis_banners
+          - login_banner_contents=cis_default
 
     - id: 1.14
       title: ensure-message-of-the-day-is-configured-properly
diff --git a/controls/std_tencentos4.yml b/controls/std_tencentos4.yml
@@ -123,6 +123,7 @@ controls:
       rules:
           - banner_etc_issue
           - login_banner_text=cis_banners
+          - login_banner_contents=cis_default
 
     - id: 1.4.3
       title: Ensure remote login warning banner is configured properly
diff --git a/controls/stig_ol9.yml b/controls/stig_ol9.yml
@@ -53,6 +53,7 @@ controls:
       rules:
           - banner_etc_issue
           - login_banner_text=dod_default
+          - login_banner_contents=dod_default
       status: automated
 
     - id: OL09-00-000020
diff --git a/controls/stig_slmicro5.yml b/controls/stig_slmicro5.yml
@@ -36,6 +36,7 @@ controls:
       rules:
           - banner_etc_issue
           - login_banner_text=dod_banners
+          - login_banner_contents=dod_default
       status: automated
 
     - id: SLEM-05-211025
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml
@@ -3,13 +3,13 @@
 # strategy = unknown
 # complexity = low
 # disruption = medium
-{{{ ansible_instantiate_variables("login_banner_text") }}}
+{{{ ansible_instantiate_variables("login_banner_contents") }}}
 
 {{%- if product not in ['sle15', 'slmicro5', 'slmicro6'] -%}}
 - name: "{{{ rule_title }}} - Ensure Correct Banner"
   ansible.builtin.copy:
     dest: /etc/issue
-    content: '{{{ ansible_deregexify_banner_etc_issue("login_banner_text") }}}'
+    content: "{{ login_banner_contents | replace('\\n', '\n') }}\n"
 {{%- else -%}}
 - name: {{{ rule_title }}} Ensure issue-generator is Installed
   ansible.builtin.package:
@@ -19,7 +19,7 @@
 - name: "{{{ rule_title }}} - Ensure Correct Banner"
   ansible.builtin.copy:
     dest: /etc/issue.d/99-oscap-setting
-    content: '{{{ ansible_deregexify_banner_etc_issue("login_banner_text") }}}'
+    content: "{{ login_banner_contents }}\n"
 
 - name: "{{{ rule_title }}} - Restart issue-generator Service on Issue Configuration Change"
   ansible.builtin.systemd:
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/bash/shared.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/bash/shared.sh
@@ -1,31 +1,11 @@
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu,multi_platform_almalinux
+# platform = multi_platform_all
 
-read -r -d '' login_banner_text <<'EOF' || true
-(bash-populate login_banner_text)
-EOF
-
-# Multiple regexes transform the banner regex into a usable banner
-# 0 - Remove anchors around the banner text
-{{{ bash_deregexify_banner_anchors("login_banner_text") }}}
-# 1 - Keep only the first banners if there are multiple
-#    (dod_banners contains the long and short banner)
-{{{ bash_deregexify_multiple_banners("login_banner_text") }}}
-# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
-{{{ bash_deregexify_banner_space("login_banner_text") }}}
-# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n")
-{{{ bash_deregexify_banner_newline("login_banner_text", "\\n") }}}
-# 4 - Remove any leftover backslash. (From any parenthesis in the banner, for example).
-{{{ bash_deregexify_banner_backslash("login_banner_text") }}}
-formatted=$(echo "$login_banner_text" | fold -sw 80)
+login_banner_contents=$(echo "(bash-populate login_banner_contents)" | sed 's/\\n/\n/g')
 
 {{%- if product not in ['sle15', 'slmicro5', 'slmicro6'] %}}
-cat <<EOF >/etc/issue
-$formatted
-EOF
+echo "$login_banner_contents" > /etc/issue
 {{%- else %}}
 {{{ bash_package_install("issue-generator") }}}
-cat <<EOF >/etc/issue.d/99-oscap-setting
-$formatted
-EOF
+echo "$login_banner_contents" > /etc/issue.d/99-oscap-setting
 {{{ bash_service_command("restart", "issue-generator") }}}
 {{%- endif -%}}
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/tests/banner_etc_issue_disa_dod_short.fail.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/tests/banner_etc_issue_disa_dod_short.fail.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# variables = login_banner_text=^I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$
+# variables = login_banner_text=^I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$,login_banner_contents=I've read &amp; consent to terms in IS user agreem't.
 
 # dod_short banner
 echo "Hello, how are you" > /etc/issue
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/tests/banner_etc_issue_disa_dod_short.pass.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/tests/banner_etc_issue_disa_dod_short.pass.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# variables = login_banner_text=^I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$
+# variables = login_banner_text=^I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$,login_banner_contents=I've read &amp; consent to terms in IS user agreem't.&#10;
 
 # dod_short banner
 echo "I've read & consent to terms in IS user agreem't." > /etc/issue
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/tests/custom_banner.fail.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/tests/custom_banner.fail.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+{{% set ts_custom_banner = "This system is made available by ABCD Inc. exclusively for\nauthorized business use. Use may be monitored for technical or\nregulatory purposes. Do not use this system if you do not consent to\nsuch monitoring.\n\nCe système est mis à disposition par la Société ABCD exclusivement\npour un usage professionnel autorisé. L'utilisation peut faire l'objet\nd'une surveillance pour des raisons techniques ou réglementaires.\nN'utilisez pas ce système si vous n'acceptez pas cette surveillance." %}}
+{{% set ts_custom_banner_regex="^This[\s\n]+system[\s\n]+is[\s\n]+made[\s\n]+available[\s\n]+by[\s\n]+ABCD[\s\n]+Inc\.[\s\n]+exclusively[\s\n]+for(?:[\n]+|(?:\\n)+)authorized[\s\n]+business[\s\n]+use\.[\s\n]+Use[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+for[\s\n]+technical[\s\n]+or(?:[\n]+|(?:\\n)+)regulatory[\s\n]+purposes\.[\s\n]+Do[\s\n]+not[\s\n]+use[\s\n]+this[\s\n]+system[\s\n]+if[\s\n]+you[\s\n]+do[\s\n]+not[\s\n]+consent[\s\n]+to(?:[\n]+|(?:\\n)+)such[\s\n]+monitoring\.(?:[\n]+|(?:\\n)+)(?:[\n]+|(?:\\n)+)Ce[\s\n]+système[\s\n]+est[\s\n]+mis[\s\n]+à[\s\n]+disposition[\s\n]+par[\s\n]+la[\s\n]+Société[\s\n]+ABCD[\s\n]+exclusivement(?:[\n]+|(?:\\n)+)pour[\s\n]+un[\s\n]+usage[\s\n]+professionnel[\s\n]+autorisé\.[\s\n]+L'utilisation[\s\n]+peut[\s\n]+faire[\s\n]+l'objet(?:[\n]+|(?:\\n)+)d'une[\s\n]+surveillance[\s\n]+pour[\s\n]+des[\s\n]+raisons[\s\n]+techniques[\s\n]+ou[\s\n]+réglementaires\.(?:[\n]+|(?:\\n)+)N'utilisez[\s\n]+pas[\s\n]+ce[\s\n]+système[\s\n]+si[\s\n]+vous[\s\n]+n'acceptez[\s\n]+pas[\s\n]+cette[\s\n]+surveillance\.$" %}}
+# variables = login_banner_contents={{{ ts_custom_banner | replace("\n", "\\n") }}},login_banner_text={{{ ts_custom_banner_regex | replace("\n", "\\n") }}}
+
+cat > /etc/issue <<'EOF'
+This is a test banner.
+EOF
diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/tests/custom_banner.pass.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/tests/custom_banner.pass.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+{{% set ts_custom_banner = "This system is made available by ABCD Inc. exclusively for\nauthorized business use. Use may be monitored for technical or\nregulatory purposes. Do not use this system if you do not consent to\nsuch monitoring.\n\nCe système est mis à disposition par la Société ABCD exclusivement\npour un usage professionnel autorisé. L'utilisation peut faire l'objet\nd'une surveillance pour des raisons techniques ou réglementaires.\nN'utilisez pas ce système si vous n'acceptez pas cette surveillance." %}}
+{{% set ts_custom_banner_regex="^This[\s\n]+system[\s\n]+is[\s\n]+made[\s\n]+available[\s\n]+by[\s\n]+ABCD[\s\n]+Inc\.[\s\n]+exclusively[\s\n]+for(?:[\n]+|(?:\\n)+)authorized[\s\n]+business[\s\n]+use\.[\s\n]+Use[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+for[\s\n]+technical[\s\n]+or(?:[\n]+|(?:\\n)+)regulatory[\s\n]+purposes\.[\s\n]+Do[\s\n]+not[\s\n]+use[\s\n]+this[\s\n]+system[\s\n]+if[\s\n]+you[\s\n]+do[\s\n]+not[\s\n]+consent[\s\n]+to(?:[\n]+|(?:\\n)+)such[\s\n]+monitoring\.(?:[\n]+|(?:\\n)+)(?:[\n]+|(?:\\n)+)Ce[\s\n]+système[\s\n]+est[\s\n]+mis[\s\n]+à[\s\n]+disposition[\s\n]+par[\s\n]+la[\s\n]+Société[\s\n]+ABCD[\s\n]+exclusivement(?:[\n]+|(?:\\n)+)pour[\s\n]+un[\s\n]+usage[\s\n]+professionnel[\s\n]+autorisé\.[\s\n]+L'utilisation[\s\n]+peut[\s\n]+faire[\s\n]+l'objet(?:[\n]+|(?:\\n)+)d'une[\s\n]+surveillance[\s\n]+pour[\s\n]+des[\s\n]+raisons[\s\n]+techniques[\s\n]+ou[\s\n]+réglementaires\.(?:[\n]+|(?:\\n)+)N'utilisez[\s\n]+pas[\s\n]+ce[\s\n]+système[\s\n]+si[\s\n]+vous[\s\n]+n'acceptez[\s\n]+pas[\s\n]+cette[\s\n]+surveillance\.$" %}}
+# variables = login_banner_contents={{{ ts_custom_banner | replace("\n", "\\n") }}},login_banner_text={{{ ts_custom_banner_regex | replace("\n", "\\n") }}}
+
+cat > /etc/issue <<'EOF'
+{{{ ts_custom_banner }}}
+EOF
diff --git a/linux_os/guide/system/accounts/accounts-banners/login_banner_text.var b/linux_os/guide/system/accounts/accounts-banners/login_banner_text.var
@@ -1,21 +1,25 @@
 documentation_complete: true
 
-title: 'Login Banner Verbiage'
+title: Login Banner Verbiage Regular Expression
 
-description: |-
-    Enter an appropriate login banner for your organization. Please note that new lines must
-    be expressed by the '\n' character and special characters like parentheses and quotation marks must be escaped with '\\'.
+description: >-
+    Enter an appropriate login banner regular expression for your organization.
+    Using a regular expression is needed because some profiles (eg. STIG) allow multiple different banners.
+    This regular expression is used only in OVAL checks.
+    In remediations the login_banner_contents variable is used instead.
+    For information about how to generate banner regular expression for your tailoring files,
+    see: https://complianceascode.readthedocs.io/en/latest/manual/developer/05_tools_and_utilities.html#generating-login-banner-regular-expressions
 
 type: string
 
 operator: equals
 
-interactive: false
+interactive: true
 
 options:
 # CIS doesn't enforce any specific content for login banners, but doesn't allow technical information.
 # There is a generic content in case a remediation is necessary.
-# How to generate banner, check https://complianceascode.readthedocs.io/en/latest/manual/developer/05_tools_and_utilities.html#generating-login-banner-regular-expressions
+# How to generate banner regex: https://complianceascode.readthedocs.io/en/latest/manual/developer/05_tools_and_utilities.html#generating-login-banner-regular-expressions
     cis_banners: ^(Authorized[\s\n]+users[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.|^(?!.*(\\|fedora|rhel|sle|ubuntu)).*)$
     cis_default: ^Authorized[\s\n]+users[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$
 # First banner in 'dod_banners' must be the banner for desktop, laptop, and other devices which accommodate banners of 1300 characters
diff --git a/products/anolis23/profiles/standard.profile b/products/anolis23/profiles/standard.profile
@@ -375,6 +375,7 @@ selections:
     ### Level 1
     - banner_etc_issue
     - login_banner_text=cis_banners
+    - login_banner_contents=cis_default
 
     ## 4.3-ensure-remote-login-warning-banner-is-configured-properly
     ### Level 1
diff --git a/products/anolis8/profiles/standard.profile b/products/anolis8/profiles/standard.profile
@@ -375,6 +375,7 @@ selections:
     ### Level 1
     - banner_etc_issue
     - login_banner_text=cis_banners
+    - login_banner_contents=cis_default
 
     ## 4.3-ensure-remote-login-warning-banner-is-configured-properly
     ### Level 1
diff --git a/products/fedora/profiles/ospp.profile b/products/fedora/profiles/ospp.profile
@@ -103,6 +103,7 @@ selections:
     - rsyslog_remote_loghost
     - auditd_audispd_encrypt_sent_records
     - login_banner_text=usgcb_default
+    - login_banner_contents=usgcb_default
     - sshd_enable_warning_banner
     - banner_etc_issue
     - sshd_rekey_limit
diff --git a/products/ol7/profiles/ncp.profile b/products/ol7/profiles/ncp.profile
@@ -36,6 +36,7 @@ extends: ospp
 selections:
     - installed_OS_is_vendor_supported
     - login_banner_text=usgcb_default
+    - login_banner_contents=usgcb_default
     - inactivity_timeout_value=15_minutes
     - var_password_pam_minlen=15
     - accounts_password_all_shadowed
diff --git a/products/ol7/profiles/stig.profile b/products/ol7/profiles/stig.profile
@@ -8,6 +8,7 @@ description: |-
 
 selections:
     - login_banner_text=dod_banners
+    - login_banner_contents=dod_default
     - inactivity_timeout_value=15_minutes
     - var_screensaver_lock_delay=5_seconds
     - sshd_idle_timeout_value=10_minutes
diff --git a/products/ol8/profiles/stig.profile b/products/ol8/profiles/stig.profile
@@ -61,6 +61,7 @@ selections:
     - var_auditd_disk_full_action=ol8
     - var_sssd_certificate_verification_digest_function=sha1
     - login_banner_text=dod_banners
+    - login_banner_contents=dod_default
     - var_authselect_profile=sssd
     - var_multiple_time_servers=stig
 
diff --git a/products/openembedded/profiles/expanded.profile b/products/openembedded/profiles/expanded.profile
@@ -114,6 +114,7 @@ selections:
     - motd_banner_text=cis_banners
     - banner_etc_issue
     - login_banner_text=cis_banners
+    - login_banner_contents=cis_default
     - file_groupowner_etc_motd
     - file_owner_etc_motd
     - file_permissions_etc_motd
diff --git a/products/openembedded/profiles/standard.profile b/products/openembedded/profiles/standard.profile
@@ -109,6 +109,7 @@ selections:
     - motd_banner_text=cis_banners
     - banner_etc_issue
     - login_banner_text=cis_banners
+    - login_banner_contents=cis_default
     - file_groupowner_etc_motd
     - file_owner_etc_motd
     - file_permissions_etc_motd
diff --git a/products/rhel10/controls/cis_rhel10.yml b/products/rhel10/controls/cis_rhel10.yml
@@ -707,6 +707,7 @@ controls:
           - dconf_gnome_banner_enabled
           - dconf_gnome_login_banner_text
           - login_banner_text=cis_banners
+          - login_banner_contents=cis_default
 
     - id: 1.8.2
       title: Ensure GDM disable-user-list is configured (Automated)
diff --git a/products/rhel8/controls/cis_rhel8.yml b/products/rhel8/controls/cis_rhel8.yml
@@ -741,6 +741,7 @@ controls:
           - dconf_gnome_banner_enabled
           - dconf_gnome_login_banner_text
           - login_banner_text=cis_banners
+          - login_banner_contents=cis_default
 
     - id: 1.8.2
       title: Ensure GDM disable-user-list is configured (Automated)
diff --git a/products/rhel8/controls/stig_rhel8.yml b/products/rhel8/controls/stig_rhel8.yml
@@ -67,6 +67,7 @@ controls:
           - var_auditd_disk_full_action=rhel8
           - var_sssd_certificate_verification_digest_function=sha1
           - login_banner_text=dod_banners
+          - login_banner_contents=dod_default
           - var_authselect_profile=sssd
           - var_multiple_time_servers=stig
           - var_time_service_set_maxpoll=18_hours
diff --git a/products/rhel8/profiles/rht-ccp.profile b/products/rhel8/profiles/rht-ccp.profile
@@ -27,6 +27,7 @@ selections:
     - var_password_pam_difok=3
     - var_password_pam_unix_remember=5
     - var_accounts_user_umask=077
+    - login_banner_contents=usgcb_default
     - login_banner_text=usgcb_default
     - partition_for_tmp
     - partition_for_var
diff --git a/products/rhel9/controls/ccn_rhel9.yml b/products/rhel9/controls/ccn_rhel9.yml
@@ -639,6 +639,7 @@ controls:
           - dconf_gnome_login_banner_text
           - sshd_enable_warning_banner_net
           - login_banner_text=cis_banners
+          - login_banner_contents=cis_default
           - remote_login_banner_text=cis_banners
 
     - id: A.11.SEC-RHEL5
diff --git a/products/rhel9/controls/stig_rhel9.yml b/products/rhel9/controls/stig_rhel9.yml
@@ -49,6 +49,7 @@ controls:
       rules:
           - banner_etc_issue
           - login_banner_text=dod_banners
+          - login_banner_contents=dod_default
       status: automated
 
     - id: RHEL-09-211030
diff --git a/products/rhv4/profiles/rhvh-stig.profile b/products/rhv4/profiles/rhvh-stig.profile
@@ -17,6 +17,7 @@ description: |-
 selections:
     - installed_OS_is_FIPS_certified
     - login_banner_text=dod_banners
+    - login_banner_contents=dod_default
     - inactivity_timeout_value=15_minutes
     - var_password_pam_minlen=15
     - accounts_password_pam_minlen
diff --git a/products/sle12/profiles/stig.profile b/products/sle12/profiles/stig.profile
@@ -32,6 +32,7 @@ selections:
     - var_password_pam_ucredit=1
     - var_accounts_maximum_age_login_defs=60
     - login_banner_text=dod_banners
+    - login_banner_contents=dod_default
     #
     # Note: must configure "var_accounts_authorized_local_users_regex" when
     # "accounts_authorized_local_users" rule is enabled
diff --git a/products/sle15/profiles/stig.profile b/products/sle15/profiles/stig.profile
@@ -31,6 +31,7 @@ selections:
     - var_accounts_maximum_age_login_defs=60
     - var_password_pam_delay=4000000
     - login_banner_text=dod_banners
+    - login_banner_contents=dod_default
     #
     # Note: must configure "var_accounts_authorized_local_users_regex" when
     # "accounts_authorized_local_users" rule is enabled
