<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
      type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <blockquote type="cite">
                <div dir="ltr">
                  <blockquote>
                    <div>240  /etc/ssh/sshd_config Banner<br>
                    </div>
                    The OVAL check was definitely working on my system
                    when I last tested it. I'm able to reproduce...<br>
                    <br>
                    [root@rhel6 checks]# cat /etc/issue<br>
                    You are accessing a U.S. Government (USG)
                    Information System (IS) that is provided for
                    USG-authorized use only. By using this IS (which
                    includes any device attached to this IS), you
                    consent to the following conditions: <br>
                    -The USG routinely intercepts and monitors
                    communications on this IS for purposes including,
                    but not limited to, penetration testing, COMSEC
                    monitoring, network operations and defense,
                    personnel misconduct (PM), law enforcement (LE), and
                    counterintelligence (CI) investigations. <br>
                    -At any time, the USG may inspect and seize data
                    stored on this IS. <br>
                    -Communications using, or data stored on, this IS
                    are not private, are subject to routine monitoring,
                    interception, and search, and may be disclosed or
                    used for any USG-authorized purpose. <br>
                    -This IS includes security measures (e.g.,
                    authentication and access controls) to protect USG
                    interests -- not for your personal benefit or
                    privacy. <br>
                    -Notwithstanding the above, using this IS does not
                    constitute consent to PM, LE or CI investigative
                    searching or monitoring of the content of privileged
                    communications, or work product, related to personal
                    representation or services by attorneys,
                    psychotherapists, or clergy, and their assistants.
                    Such communications and work product are private and
                    confidential. See User Agreement for details.<br>
                    <br>
                    [root@rhel6 checks]# ./testcheck.py
                    sshd_banner_set.xml <br>
                    Evaluating with OVAL tempfile :
                    /tmp/sshd_banner_setXKCJxI.xml<br>
                    Writing results to :
                    /tmp/sshd_banner_setXKCJxI.xml-results<br>
                    Definition oval:scap-security-guide.testing:def:193:
                    false<br>
                    Definition oval:scap-security-guide.testing:def:191:
                    false<br>
                    Definition oval:scap-security-guide.testing:def:190:
                    false<br>
                    Evaluation done.<br>
                    <br>
                    Maura, do you want to take a stab at this (noticed
                    your signoff on the OVAL)?<br>
                    <br>
                    FWIW, if I used the USGCB banner everything worked
                    OK.<br>
                    <br>
                  </blockquote>
                </div>
              </blockquote>
            </div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    <br>
    The ONLY thing the check is doing is checking that the line 'Banner
    /etc/issue' exists in /etc/ssh/sshd_config or that sshd is disabled.
    It doesn't care about the content of /etc/issue at all. I have no
    idea why it's failing for both of you guys. Full check is below my
    signature for comparison.<br>
    <br>
    - Maura Dailey<br>
    <br>
    &lt;def-group&gt;<br>
      &lt;definition class="compliance" id="sshd_banner_set"
    version="1"&gt;<br>
        &lt;metadata&gt;<br>
          &lt;title&gt;Enable a Warning Banner&lt;/title&gt;<br>
          &lt;affected family="unix"&gt;<br>
            &lt;platform&gt;Red Hat Enterprise Linux 6&lt;/platform&gt;<br>
          &lt;/affected&gt;<br>
          &lt;description&gt;SSH warning banner should be enabled (and
    dependencies are<br>
          met)&lt;/description&gt;<br>
          &lt;reference source="MED" ref_id="20130813"
    ref_url="test_attestation" /&gt;<br>
        &lt;/metadata&gt;<br>
        &lt;criteria comment="SSH is not being used or conditions are
    met"<br>
        operator="OR"&gt;<br>
          &lt;extend_definition comment="sshd service is disabled"<br>
          definition_ref="service_sshd_disabled" /&gt;<br>
          &lt;criterion comment="Check Banner in /etc/ssh/sshd_config"<br>
          test_ref="test_sshd_banner_set" /&gt;<br>
        &lt;/criteria&gt;<br>
      &lt;/definition&gt;<br>
      &lt;ind:textfilecontent54_test check="all"
    check_existence="all_exist"<br>
      comment="Tests the value of the Banner[\s]+/etc/issue setting in
    the /etc/ssh/sshd_config file"<br>
      id="test_sshd_banner_set" version="1"&gt;<br>
        &lt;ind:object object_ref="obj_sshd_banner_set" /&gt;<br>
      &lt;/ind:textfilecontent54_test&gt;<br>
      &lt;ind:textfilecontent54_object id="obj_sshd_banner_set"
    version="1"&gt;<br>
        &lt;ind:path&gt;/etc/ssh&lt;/ind:path&gt;<br>
        &lt;ind:filename&gt;sshd_config&lt;/ind:filename&gt;<br>
        &lt;ind:pattern operation="pattern
    match"&gt;^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*$&lt;/ind:pattern&gt;<br>
        &lt;ind:instance datatype="int"&gt;1&lt;/ind:instance&gt;<br>
      &lt;/ind:textfilecontent54_object&gt;<br>
    &lt;/def-group&gt;<br>
  </body>
</html>