The ONLY thing the check is doing is checking that the line 'Banner
/etc/issue' exists in /etc/ssh/sshd_config or that sshd is disabled.
It doesn't care about the content of /etc/issue at all. I have no
idea why it's failing for both of you guys. Full check is below my
signature for comparison.
- Maura Dailey
<def-group>
<definition class="compliance" id="sshd_banner_set"
version="1">
<metadata>
<title>Enable a Warning Banner</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>SSH warning banner should be enabled (and
dependencies are
met)</description>
<reference source="MED" ref_id="20130813"
ref_url="test_attestation" />
</metadata>
<criteria comment="SSH is not being used or conditions are
met"
operator="OR">
<extend_definition comment="sshd service is disabled"
definition_ref="service_sshd_disabled" />
<criterion comment="Check Banner in /etc/ssh/sshd_config"
test_ref="test_sshd_banner_set" />
</criteria>
</definition>
<ind:textfilecontent54_test check="all"
check_existence="all_exist"
comment="Tests the value of the Banner[\s]+/etc/issue setting in
the /etc/ssh/sshd_config file"
id="test_sshd_banner_set" version="1">
<ind:object object_ref="obj_sshd_banner_set" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_sshd_banner_set"
version="1">
<ind:path>/etc/ssh</ind:path>
<ind:filename>sshd_config</ind:filename>
<ind:pattern operation="pattern
match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>