Computer Center Security Services

Warning Banner Installation -- Linux, Solaris, and HP

Background

During the login process, a UNIX-based machine will authenticate a login request using a dedicated process (login, sshd, telnetd, etc) and then either invoke an interactive shell or run a command that is passed as an argument with the login request (e.g., ssh jlabs1 date).

Command-line shells (including bash, ksh, csh, and tcsh) normally have the capability of executing a specific, system-wide script when they are invoked as an interactive login process. The following table shows the names of the login scripts that are used by common shells during an interactive login on various operating systems.

OS type	shell	login script name
Linux	csh, tcsh	/etc/csh.login
	bash, sh	/etc/profile
HP-UX	csh, tcsh	/etc/csh.login
	bash, ksh, sh	/etc/profile
Solaris	csh, tcsh	/etc/.login <-- note it is "dot" login
	bash, ksh, sh	/etc/profile

Notes

tcsh will reference its own set of login and startup scripts if they exist. If they do not exist, tcsh will default to those used by csh. This is the mode assumed here -- if you wish to have separate login scripts for tcsh, check the man page.

Linux installs bash as a functional replacement for sh.

A command like ssh hostname /bin/csh is not considered an interactive login by the system and thus the scripts above will not be processed.

What text and command to install

The current text for the banner is on a central file system and should be copied to a local file to be accessible for each login. The following commands will do it:

  (as root)
  mkdir -p /mnt/tmpsite
  mount fs1:/site /mnt/tmpsite
  cp -f /mnt/tmpsite/etc/issue-jlab /etc/issue-jlab
  chmod a+r /etc/issue-jlab
  umount /mnt/tmpsite
  rmdir /mnt/tmpsite

With the banner content in place, add the following line to the bottom of /etc/profile and either /etc/csh.login (Linux and HP) or /etc/.login (Solaris) -- if these files don't exist, create them:

  cat /etc/issue-jlab

If you start getting more than one banner listing, previous techniques may have put banners in /etc/motd, /etc/issue, or /etc/issue.net. The banner text can be removed from these files. The latter two files are created by /etc/rc.d/rc.local on Linux boxes. The code that creates them should be removed if it installs the JLab banner when the system boots.

This document is maintained by {helpdesk@jlab.org}