Merge "Display MOTD warning banner [+Docs]"

defaults/main.yml

@@ -558,7 +558,7 @@ security_sshd_disallow_host_based_auth: yes                  # RHEL-07-010442
 # Set a list of allowed ssh ciphers.
 security_sshd_cipher_list: 'aes128-ctr,aes192-ctr,aes256-ctr' # RHEL-07-040110
 # Specify a text file to be displayed as the banner/MOTD for all sessions.
-security_sshd_banner_file: /etc/issue.net                    # RHEL-07-040170
+security_sshd_banner_file: /etc/motd                         # RHEL-07-010040 / RHEL-07-040170
 # Set the interval for max session length and the number of intervals to allow.
 security_sshd_client_alive_interval: 600                     # RHEL-07-040190
 security_sshd_client_alive_count_max: 0                      # RHEL-07-040191

doc/metadata/rhel7/RHEL-07-010040.rst

@@ -4,4 +4,6 @@ status: not implemented
 tag: misc
 ---
 
-This STIG requirement is not yet implemented.
+This control is implemented by the tasks for another control:
+
+* :ref:`stig-RHEL-07-040170`

doc/metadata/rhel7/RHEL-07-040170.rst

@@ -4,7 +4,16 @@ status: implemented
 tag: sshd
 ---
 
-The ``Banner`` configuration is set to ``/etc/issue.net`` in
-``/etc/ssh/sshd_config`` and sshd is restarted. In addition, the
-``files/login_banner.txt`` file is copied from the openstack-ansible-security
-role directory to ``/etc/issue.net`` on each host.
+The tasks in the security role deploy a standard notice and consent banner into
+``/etc/motd`` on each server.  Ubuntu, CentOS and Red Hat Enterprise Linux
+display this banner after each successful login via ssh or the console.
+
+Deployers can choose a different destination for the banner by setting the
+following Ansible variable:
+
+.. code-block:: yaml
+
+    security_sshd_banner_file: /etc/motd
+
+The text of the banner file is configurable by editing
+``files/login_banner.txt`` in the security role.

tasks/rhel7stig/sshd.yml

@@ -28,7 +28,7 @@
     - always
     - sshd
 
-- name: RHEL-07-040170 - Copy login warning banner
+- name: Copy login warning banner
   copy:
     src: login_banner.txt
     dest: "{{ security_sshd_banner_file }}"
@@ -37,6 +37,7 @@
   tags:
     - high
     - sshd
+    - RHEL-07-010040
     - RHEL-07-040170
 
 - name: Adjust ssh server configuration based on STIG requirements