On 11/27/12 8:41 AM, David Smith wrote:
Agreed. The criteria by which we're supposed to be deciding which things are important (and their respective degrees of importance) points directly to impact on confidentiality/integrity/availability. I'm not seeing how the login banner addresses any of those areas.
Then why do we have an entire section on login banners, mapped to some 16 different government policies? http://people.redhat.com/swells/scap-security-guide/RHEL6/output/rhel6-guide...
Current RHEL-based login banners do not specifically log user acceptance, and to mitigate that most accepted banner prose includes language around "by continuing past this point.... you accept." Legal people have found this to be perfectly acceptable and for that reason it appears we can move on (which it appears David and Jeff are getting at).
With that said, should users want RHEL to natively log such acceptances, they should put in an RFE through their vendor rep. I'll be happy to assist people with putting in RFEs should they not know who their Red Hat contact is.