securing oracle linux 9 part 8 configuring command line warning banners

وحید نوروزی سیستم عامل و زیرساخت 30 July 2026 Hits: 1

In the previous part
<h1><a href="/fa/os/os-infra/securing-oracle-linux-9-part-7-configuring-system-wide-crypto-policy-fa">Configuring the System-wide Crypto Policy</a></h1>
was completed.

1. CIS Benchmark Requirements (Section 1.7)
This section focuses on implementing and properly configuring legal warning banners for system logins, and includes the following CIS controls:
<ul>
<li>1.7.1 Ensure message of the day is configured properly (Automated)</li>
<li>1.7.2 Ensure local login warning banner is configured properly (Automated)</li>
<li>1.7.3 Ensure remote login warning banner is configured properly (Automated)</li>
<li>1.7.4 Ensure access to /etc/motd is configured (Automated)</li>
<li>1.7.5 Ensure access to /etc/issue is configured (Automated)</li>
<li>1.7.6 Ensure access to /etc/issue.net is configured (Automated)</li>
</ul>

2. Concept & Rationale
Displaying warning messages to users who connect to the system, whether locally or remotely, is a critical legal and security requirement. These banners inform users that the system is monitored and that unauthorized access is subject to legal action.
<ul>
<li>/etc/issue: The contents of this file are displayed before the login prompt on local terminals (Console/TTY).</li>
<li>/etc/issue.net: The contents of this file are shown before login for remote connections such as SSH.</li>
<li>/etc/motd (Message of the Day): The contents of this file are displayed after successful authentication.</li>
<li>Information Leakage: It is important not to use control characters such as \m, \r, \s, and \v in these files, because they may reveal exact operating system and kernel information.</li>
<li>Permissions: To prevent ordinary users or malware from modifying these messages, the files must be owned by root:root (UID 0 and GID 0) and their permissions must be set exactly to 0644.</li>
</ul>

3. Oracle Database Compatibility Check (RAC, ASM, Grid)
Configuring warning banners is a security measure at the operating system's interactive access layer.
<ul>
<li>No Interference: Changing the contents of /etc/issue or /etc/motd does not interfere with Oracle Database, Grid Infrastructure services, inter-node communication, or installation and patching processes such as OUI and OPatch.</li>
<li>Automated Scripts: Oracle tools running in the background in non-interactive shells are not affected by these messages. These changes are completely safe for Oracle RAC and standalone environments.</li>
</ul>

4. Checking the Current Status (Audit Script)
This script verifies file presence and permissions, and also ensures that sensitive operating system information is not leaked through the banners.
GitHub link:
<a href="https://github.com/vahiddb/ol9-cis-hardening/blob/main/modules/audit_08_Warning_Banners.sh">modules/audit_08_Warning_Banners.sh</a>
If you are not familiar with bash scripts, you can refer to the training material I have published on the site for database administrators.
<h1><a href="/fa/os/os-infra/bash-for-oracle-dbas-part-1-conditions-in-bash-if-test-fa">Bash for Oracle DBAs</a></h1>

#!/bin/bash # Script: audit_cis_1_7.sh # Purpose: Audit Warning Banners Content and Permissions
echo -e "\n[+] Auditing CIS 1.7: Command Line Warning Banners..."
FILES=("/etc/motd" "/etc/issue" "/etc/issue.net")
for FILE in "${FILES[@]}"; do echo "[*] Checking $FILE..." if [ -e "$FILE" ]; then # Check permissions and ownership (CIS 1.7.4 - 1.7.6) STAT=$(stat -c "%a %U %G" "$FILE") if [ "$STAT" == "644 root root" ]; then echo " [OK] Permissions and ownership are correct ($STAT)." else echo " [!] WARNING: Incorrect permissions/ownership. Current: $STAT. Expected: 644 root root." fi
 # Check for OS information leaks (CIS 1.7.1 - 1.7.3
#!/bin/bash # Script: audit8.sh # Purpose: Audit Command Line Warning Banners (CIS 1.7)
echo "==========================================================================" echo " CIS Requirement: 1.7 Command Line Warning Banners" echo " - Ensure /etc/motd, /etc/issue, and /etc/issue.net are configured." echo " - Ensure permissions are 644 and ownership is root:root." echo " - Ensure no OS or kernel information is leaked." echo " Oracle Context:" echo " - Modifying warning banners has NO impact on Oracle Database/RAC." echo " - Standard banners do not interfere with Oracle automated tasks." echo "=========================================================================="
FAIL_COUNT=0 FILES=("/etc/motd" "/etc/issue" "/etc/issue.net") OS_NAME=$(grep '^ID=' /etc/os-release | cut -d= -f2 | sed -e 's/"//g')
echo -e "\n[*] Auditing Warning Banners and Permissions..."
for FILE in "${FILES[@]}"; do echo "[*] Checking $FILE..." if [ -e "$FILE" ]; then # Check permissions and ownership STAT=$(stat -c "%a %U %G" "$FILE") if [ "$STAT" == "644 root root" ]; then echo -e " \e[32m[PASS]\e[0m Permissions and ownership are correct ($STAT)." else echo -e " \e[31m[FAIL]\e[0m Incorrect permissions/ownership. Current: $STAT (Expected: 644 root root)." FAIL_COUNT=$((FAIL_COUNT + 1)) fi
 # Check for OS information leaks if grep -E -i "(\\\v|\\\r|\\\m|\\\s|$OS_NAME)" "$FILE" > /dev/null 2>&1; then echo -e " \e[31m[FAIL]\e[0m OS or Kernel information leakage detected." FAIL_COUNT=$((FAIL_COUNT + 1)) else echo -e " \e[32m[PASS]\e[0m No OS information leaks detected." fi else echo -e " \e[31m[FAIL]\e[0m File $FILE does not exist." FAIL_COUNT=$((FAIL_COUNT + 1)) fi done
if [ "$FAIL_COUNT" -eq 0 ]; then echo -e "\n\e[32m[+] AUDIT RESULT: PASS\e[0m" else echo -e "\n\e[31m[-] AUDIT RESULT: FAIL ($FAIL_COUNT issues found)\e[0m" fi

<h2 dir="rtl" lang="fa">5. Applying the Configuration (Remediation Bash Script)</h2>
The following script configures the standard banner content in a consistent way and restricts file permissions.
GitHub link:
<a href="https://github.com/vahiddb/ol9-cis-hardening/blob/main/modules/remediate_08_Warning_Banners.sh">modules/remediate_08_Warning_Banners.sh</a>

In the next part
<h1><a href="/fa/os/os-infra/securing-oracle-linux-9-part-9-configuring-and-managing-gnome-display-manager-gdm-fa">Configuring and Managing GNOME Display Manager (GDM)</a></h1>
we will continue.