Loose ends of security hardening

[Douglas Cameron]

How does one do the following in the most efficient and reliable manner:
Getting rid of all welcome banners before login prompts, getting rid of daemon banners, and making sure that these will stay hardened after a reboot?

Thanks.

[Jeff_Traigle · Accepted solution]

I don't know that you really want to get rid of banners completely. You definitely want to get rid of the standard ones that advertise what OS you're running though. :) Typically, auditors want to see some "authorized access only" message in the banner. Changes will persist reboots since these are saved in configuration files (typically /etc/issue is the one you configure all the daemons to use since it's the one login uses anyway).

How this is configured for each daemon will depend on the services you have running that allow remote access to the system. Telnet(1) uses login(1) so /etc/issue is used. If you use ftp, check out the ftpaccess(5) man page for the greeting and banner parameters. sshd_config has a Banner parameter, which is not defined by default, you can set for sshd.

Those are the common services I can think of offhand that you're likely to be using.

[Douglas Cameron]

Jeff,

Thanks for the answers. I did find that putting telnetd -b /etc/issue did keep it from displaying host information; but am keeping in mind to look at all the services that may issue banners.

Thanks again -

[Douglas Cameron]

Jeff and I have found the same answer, and Jeff did mention other things to look out for. Thanks!