Hi,
I have exactly the same results but that’s not the point. This is what I get on a system without a ‘Banner’ but with a 'Match' group:
[root@seis64 ~]# ssh localhost
root@localhost's password:
[root@seis64 ~]# sshd_enable_warning_banner.sh
[root@seis64 ~]# /etc/init.d/sshd restart
Stopping sshd: [ OK ]
Starting sshd: [ OK ]
[root@seis64 ~]# ssh localhost
root@localhost's password:
Still no banner.
This is because the ‘Banner’ was appended to the end of sshd_config and got ‘absorved’ by the Match rules (that use anything following 'Match' until EOF or another 'Match'):
[root@seis64 ~]# tail -5 /etc/ssh/sshd_config
# Rules for sftponly group
Match group sftponly
X11Forwarding no
AllowTcpForwarding no
Banner /etc/issue
This applies to all SSG's sshd_config fixes. Note not all configuration primitives are acceptable on the “Match” blocks, meaning starting sshd will fail.
Bottom line, new primitives must be inserted *before* Match blocks.