diff --git a/defaults/main.yml b/defaults/main.yml index 8b97d8c0..13ab53fe 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -334,6 +334,8 @@ security_sshd_disallow_host_based_auth: yes # V-71959 security_sshd_cipher_list: 'aes128-ctr,aes192-ctr,aes256-ctr' # V-72221 # Specify a text file to be displayed as the banner/MOTD for all sessions. security_sshd_banner_file: /etc/motd # V-71861 / V-72225 +# Disable dynamic MOTD banner that is provided by /run/motd.dynamic +security_sshd_dynamic_banner_disable: True # Set the interval for max session length and the number of intervals to allow. security_sshd_client_alive_interval: 600 # V-72237 security_sshd_client_alive_count_max: 0 # V-72241 diff --git a/tasks/rhel7stig/sshd.yml b/tasks/rhel7stig/sshd.yml index 72e7b722..2832be0a 100644 --- a/tasks/rhel7stig/sshd.yml +++ b/tasks/rhel7stig/sshd.yml @@ -148,3 +148,11 @@ - medium - sshd - V-72257 + +- name: Remove motd from pam.d + lineinfile: + path: /etc/pam.d/sshd + regexp: '^(#\s)?(session\s*optional\s*pam_motd.so.*)$' + line: '{{ (security_sshd_dynamic_banner_disable | bool) | ternary("# \2", "\2") }}' + backrefs: yes + when: security_sshd_dynamic_banner_disable | bool diff --git a/vars/main.yml b/vars/main.yml index 4eb1d867..9342b76d 100644 --- a/vars/main.yml +++ b/vars/main.yml @@ -430,3 +430,7 @@ sshd_settings_rhel7: value: "yes" enabled: "{{ security_sshd_enable_strict_modes | bool }}" stig_id: V-72263 + - name: PrintMotd + value: "{{ (security_sshd_dynamic_banner_disable | bool) | ternary('yes', 'no') }}" + enabled: true + stig_id: V-71861