If you are working a lot with linux/network devices a login banner is something that you see every day, but probably don’t put a lot of thought into. Broadly speaking the login banner should be on all external (not local to device) administrative interfaces.
The purpose of a legal banner is to:
- Provide Legal Protection should evidence need to be used from a device.
- Act as a deterrent to potential intruders
This banner must be displayed prior to login.
There are certain items that must be included in a legal banner. These include:
- Statement that the device is for authorized users only
- The device is for official use only.
- Users have no expectations of privacy.
- All access and use may (not will) be monitored and/or recorded.
- Monitoring and/or recording may be turned over to the appropriate authorities.
- Use of the system implies consent to the previously mentioned conditions.
The banner must not contain:
- Mention of the purpose, location or owner of the device or any other identification information.
- It should not say “Welcome” anywhere in the description.
If you really want to provide information on the device name, owner, cool ASCII art, etc. then that can be done post-login, as part of the MOTD, for example.
Consider a sample banner below:
*** WARNING *** This system is private and may be accessed only by authorized users for official purposes. The system owner reserves the right to monitor any and all activity taking place on this system and any attempts to connect to it. Individuals using this computer system are subject to having all of their activities monitored and recorded by system personnel. Use of this system evidences an express consent to such monitoring and agreement that if such monitoring reveals evidence of possible abuse or criminal activity, system personnel may provide the results of such monitoring to appropriate officials. Unauthorized users or users who exceed (or attempt to exceed), their authorized level of access are subject to prosecution under any local or international laws that apply as well as Company initiated proceedings.
