DEV Community

Janak Shrestha
Janak Shrestha

Posted on

Linux Banner

#linux #devops #bannerdeployment

During the monthly compliance meeting, it was pointed out that several servers in the Stratos DC do not have a valid banner. The security team has provided serveral approved templates which should be applied to the servers to maintain compliance. These will be displayed to the user upon a successful login.

Update the message of the day on all application servers for Nautilus. Make use of the approved template located at /home/thor/nautilus_banner on the jump host.

1. Understanding MOTD and Security Banners

What is MOTD?

MOTD stands for Message of the Day. It's a text file (/etc/motd) that is displayed to users after they successfully authenticate to a Linux system. The content of this file is shown immediately after login, before the shell prompt appears.

Purpose of Security Banners

Security banners serve several critical functions:

Purpose Description
Legal Protection Warns unauthorized users about legal consequences of accessing systems without permission
Compliance Required by security frameworks (PCI-DSS, HIPAA, ISO 27001, etc.)
User Awareness Reminds authorized users about acceptable usage policies
Audit Trail Helps establish accountability for system access
Reporting Provides a point of contact for reporting security incidents

MOTD vs Other Banner Types

Location Purpose Display Time
/etc/motd Post-login banner After successful authentication
/etc/issue Pre-login banner (local terminal) Before login prompt (physical/console)
/etc/issue.net Pre-login banner (SSH) Before SSH login prompt
SSH Banner in /etc/ssh/sshd_config SSH pre-login banner Before SSH authentication

Note: /etc/motd is the most common method for displaying security banners in enterprise environments.

2. Preparing the Banner Template

Creating an Effective Security Banner

An effective security banner should include:

  1. Clear Warning: "This system is monitored"
  2. Legal Statement: Unauthorized access is prohibited
  3. System Purpose: What the system is used for
  4. Acceptable Use: Summary of acceptable use policy
  5. Contact Information: Who to contact for issues
  6. Consent Statement: Continued use implies consent

Example Banner Template 

################################################################################
  .__   __.      ___      __    __  .___________. __   __       __    __       
       |  \ |  |     /   \    |  |  |  | |           ||  | |  |     |  |  |  | 
       |   \|  |    /  ^  \   |  |  |  | `---|  |----`|  | |  |     |  |  |  |
       |  . `  |   /  /_\  \  |  |  |  |     |  |     |  | |  |     |  |  |  |
       |  |\   |  /  _____  \ |  `--'  |     |  |     |  | |  `----.|  `--'  |
       |__| \__| /__/     \__\ \______/      |__|     |__| |_______| \______/

                                 # #  ( )                                      
                                  ___#_#___|__                                 
                              _  |____________|  _                             
                       _=====| | |            | | |==== _                      
                 =====| |.---------------------------. | |====                 
   <--------------------'   .  .  .  .  .  .  .  .   '--------------/          
     \                                                             /           
      \_______________________________________________WWS_________/            
  wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww        
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww       
   wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww         

################################################################################

                     ⚠️  WARNING ⚠️

This system is the property of Nautilus Corporation and is 
provided for authorized use only.

By logging in, you consent to monitoring and auditing of all
activity on this system.

Unauthorized access or use is prohibited and may result in:
- Disciplinary action
- Civil liability
- Criminal prosecution

System usage is subject to the Nautilus Acceptable Use Policy.

For questions or assistance, contact:
- IT Support: support@nautilus.com
- Security Team: security@nautilus.com

################################################################################

        ALL USERS ARE SUBJECT TO MONITORING
        UNAUTHORIZED ACCESS IS PROHIBITED
        BY USING THIS SYSTEM YOU CONSENT TO MONITORING

################################################################################
Enter fullscreen mode Exit fullscreen mode

3. Understanding the Deployment Challenges

Common Challenges When Deploying MOTD

Challenge Description Solution
Password Prompting Multiple sudo commands prompt for passwords individually Use a single sudo session with bash -c
File Permissions /etc/motd must be owned by root with correct permissions Set ownership and permissions after deployment
Formatting Issues ASCII art may not display correctly if copied incorrectly Use cat or scp to preserve formatting
Multi-Server Deployment Manual deployment to multiple servers is time-consuming Use scripts or automation tools
Verification Need to confirm deployment success on all servers Use verification commands

The Password Problem: A Common Pitfall

When running multiple sudo commands in a single SSH session, the password is only passed to the first sudo command:

# ❌ THIS WILL FAIL (only first sudo gets password)
echo 'password' | ssh user@server "sudo -S cmd1 && sudo -S cmd2 && sudo -S cmd3"

# ✅ THIS WORKS (single sudo session)
echo 'password' | ssh user@server "sudo -S bash -c 'cmd1 && cmd2 && cmd3'"
Enter fullscreen mode Exit fullscreen mode

4. Manual Deployment Process

Prerequisites

  • SSH access to the jump host and target servers
  • Sudo privileges on target servers
  • Banner template file ready

Step 1: Verify the Banner Template 

# Connect to jump host
ssh thor@jump-host
# Password: mjolnir123

# Check the template
cat /home/thor/nautilus_banner
Enter fullscreen mode Exit fullscreen mode

Step 2: Deploy to a Single Server

Method 1: Using SCP and Single Sudo Session (Recommended) 

# Copy the file
scp /home/thor/nautilus_banner tony@stapp01:/tmp/
# Password: Ir0nM@n

# Execute all commands with a single sudo session
ssh tony@stapp01 << 'EOF'
echo 'Ir0nM@n' | sudo -S bash -c '
mv /tmp/nautilus_banner /etc/motd
chown root:root /etc/motd
chmod 644 /etc/motd
echo "=== Banner deployed on stapp01 ==="
cat /etc/motd
'
EOF
Enter fullscreen mode Exit fullscreen mode

Method 2: Using Heredoc with SSH 

scp /home/thor/nautilus_banner tony@stapp01:/tmp/ && echo 'Ir0nM@n' | ssh tony@stapp01 "sudo -S bash -c 'mv /tmp/nautilus_banner /etc/motd && chown root:root /etc/motd && chmod 644 /etc/motd && cat /etc/motd'"
Enter fullscreen mode Exit fullscreen mode

Step 3: Deploy to All Servers

App Server 1 (stapp01) - User: tony 

scp /home/thor/nautilus_banner tony@stapp01:/tmp/ && echo 'Ir0nM@n' | ssh tony@stapp01 "sudo -S bash -c 'mv /tmp/nautilus_banner /etc/motd && chown root:root /etc/motd && chmod 644 /etc/motd && cat /etc/motd'"
Enter fullscreen mode Exit fullscreen mode

App Server 2 (stapp02) - User: steve 

scp /home/thor/nautilus_banner steve@stapp02:/tmp/ && echo 'Am3ric@' | ssh steve@stapp02 "sudo -S bash -c 'mv /tmp/nautilus_banner /etc/motd && chown root:root /etc/motd && chmod 644 /etc/motd && cat /etc/motd'"
Enter fullscreen mode Exit fullscreen mode

App Server 3 (stapp03) - User: banner 

scp /home/thor/nautilus_banner banner@stapp03:/tmp/ && echo 'BigGr33n' | ssh banner@stapp03 "sudo -S bash -c 'mv /tmp/nautilus_banner /etc/motd && chown root:root /etc/motd && chmod 644 /etc/motd && cat /etc/motd'"
Enter fullscreen mode Exit fullscreen mode

5. Automated Deployment Methods

Method 1: Complete Bash Script 

#!/bin/bash

# Configuration
BANNER_FILE="/home/thor/nautilus_banner"

# Server credentials
declare -A SERVERS=(
    ["stapp01"]="tony:Ir0nM@n"
    ["stapp02"]="steve:Am3ric@"
    ["stapp03"]="banner:BigGr33n"
)

echo "========================================="
echo "Deploying MOTD Banner to App Servers"
echo "========================================="

# Check if banner exists
if [ ! -f "$BANNER_FILE" ]; then
    echo "❌ Banner file not found: $BANNER_FILE"
    exit 1
fi

echo "✅ Banner template found"
echo ""

# Deploy to each server
for server in "${!SERVERS[@]}"; do
    IFS=':' read -r user pass <<< "${SERVERS[$server]}"

    echo "========================================="
    echo "Deploying to $server (User: $user)"
    echo "========================================="

    # Copy the banner file
    echo "Copying banner file..."
    scp "$BANNER_FILE" "$user@$server:/tmp/"

    if [ $? -ne 0 ]; then
        echo "❌ Failed to copy banner to $server"
        continue
    fi

    # Execute deployment commands
    echo "Deploying banner..."
    ssh "$user@$server" << EOF
echo '$pass' | sudo -S bash -c '
mv /tmp/nautilus_banner /etc/motd
chown root:root /etc/motd
chmod 644 /etc/motd
echo "✅ Banner deployed successfully on $server"
echo ""
echo "=== Banner content ==="
cat /etc/motd
'
EOF

    if [ $? -eq 0 ]; then
        echo "✅ $server completed successfully"
    else
        echo "❌ Failed to deploy on $server"
    fi

    echo ""
done

echo "========================================="
echo "✅ Banner deployment complete!"
echo "========================================="
Enter fullscreen mode Exit fullscreen mode

Running the Script: 

chmod +x deploy_banner.sh
./deploy_banner.sh
Enter fullscreen mode Exit fullscreen mode

Method 2: Using SSH Command with Heredoc 

#!/bin/bash

BANNER_FILE="/home/thor/nautilus_banner"

deploy_banner() {
    local server=$1
    local user=$2
    local pass=$3

    echo "=== Deploying to $server ==="
    scp "$BANNER_FILE" "$user@$server:/tmp/"

    ssh "$user@$server" << EOF
echo '$pass' | sudo -S bash -c '
mv /tmp/nautilus_banner /etc/motd
chown root:root /etc/motd
chmod 644 /etc/motd
echo "✅ $server completed"
'
EOF
}

# Deploy to each server
deploy_banner "stapp01" "tony" "Ir0nM@n"
deploy_banner "stapp02" "steve" "Am3ric@"
deploy_banner "stapp03" "banner" "BigGr33n"
Enter fullscreen mode Exit fullscreen mode

Method 3: Using Ansible (Infrastructure as Code)

For larger environments, consider using Ansible:

---
- name: Deploy MOTD Banner
  hosts: all
  become: yes
  tasks:
    - name: Copy MOTD template
      copy:
        src: /home/thor/nautilus_banner
        dest: /etc/motd
        owner: root
        group: root
        mode: 0644
      notify:
        - Display MOTD

  handlers:
    - name: Display MOTD
      debug:
        msg: "MOTD updated successfully!"
Enter fullscreen mode Exit fullscreen mode

6. Verification and Validation

Step 1: Verify Banner Content 

# Check each server
echo "=== stapp01 ==="
ssh tony@stapp01 "cat /etc/motd"

echo "=== stapp02 ==="
ssh steve@stapp02 "cat /etc/motd"

echo "=== stapp03 ==="
ssh banner@stapp03 "cat /etc/motd"
Enter fullscreen mode Exit fullscreen mode

Step 2: Verify File Permissions 

# Check all servers
for server in stapp01 stapp02 stapp03; do
    echo "=== $server ==="
    ssh "$server" "ls -la /etc/motd"
done
Enter fullscreen mode Exit fullscreen mode

Expected Output:

-rw-r--r-- 1 root root 2530 Sep 1 10:00 /etc/motd
Enter fullscreen mode Exit fullscreen mode

Step 3: Verify File Ownership 

# Check all servers
for server in stapp01 stapp02 stapp03; do
    echo "=== $server ==="
    ssh "$server" "stat -c '%U:%G' /etc/motd"
done
Enter fullscreen mode Exit fullscreen mode

Expected Output:

root:root
Enter fullscreen mode Exit fullscreen mode

Step 4: Verify by Logging In 

# Test by SSHing to the server
ssh tony@stapp01
Enter fullscreen mode Exit fullscreen mode

You should see the banner displayed after successful login.

Step 5: Complete Verification Script 

#!/bin/bash

echo "========================================="
echo "Verifying MOTD Deployment"
echo "========================================="

for server in stapp01 stapp02 stapp03; do
    echo ""
    echo "=== $server ==="

    # Get the appropriate user
    case $server in
        stapp01) user="tony" ;;
        stapp02) user="steve" ;;
        stapp03) user="banner" ;;
    esac

    echo "File existence:"
    ssh "$user@$server" "test -f /etc/motd && echo '✅ File exists' || echo '❌ File missing'"

    echo "File ownership:"
    ssh "$user@$server" "stat -c '%U:%G %a' /etc/motd 2>/dev/null || echo '❌ Not found'"

    echo "File size:"
    ssh "$user@$server" "stat -c '%s bytes' /etc/motd 2>/dev/null || echo '❌ Not found'"

    echo "Banner preview (first 3 lines):"
    ssh "$user@$server" "head -3 /etc/motd 2>/dev/null || echo '❌ Cannot read file'"
done

echo ""
echo "========================================="
echo "✅ Verification complete!"
echo "========================================="
Enter fullscreen mode Exit fullscreen mode

7. Troubleshooting Common Issues

Issue 1: "sudo: a password is required"

Problem: Multiple sudo commands without proper password handling.

Fix: Use a single sudo session:

# ❌ Wrong
ssh user@server "sudo -S cmd1 && sudo -S cmd2"

# ✅ Correct
ssh user@server "sudo -S bash -c 'cmd1 && cmd2'"
Enter fullscreen mode Exit fullscreen mode

Issue 2: "Permission denied" when moving file

Problem: Insufficient privileges to write to /etc/motd.

Fix: Ensure you're using sudo or running as root:

sudo mv /tmp/nautilus_banner /etc/motd
Enter fullscreen mode Exit fullscreen mode

Issue 3: Banner not displaying on login

Problem: SSH configuration may be overriding MOTD.

Fix: Check SSH configuration:

# Check for Banner configuration
grep -i banner /etc/ssh/sshd_config

# Ensure PrintMotd is enabled
grep -i printmotd /etc/ssh/sshd_config
# Should be: PrintMotd yes
Enter fullscreen mode Exit fullscreen mode

Fix: Restart SSH service:

sudo systemctl restart sshd
Enter fullscreen mode Exit fullscreen mode

Issue 4: File formatting issues

Problem: ASCII art or formatting is broken.

Fix: Use cat to preserve formatting:

# Copy with cat (preserves exact formatting)
cat /home/thor/nautilus_banner | ssh user@server "sudo tee /etc/motd > /dev/null"
Enter fullscreen mode Exit fullscreen mode

Issue 5: Script fails silently

Problem: Errors not being displayed.

Fix: Add error handling:

#!/bin/bash
set -e  # Exit on error
set -x  # Print commands being executed
Enter fullscreen mode Exit fullscreen mode

Issue 6: Authentication issues in scripts

Problem: Script prompts for password multiple times.

Fix: Use sshpass for automated password handling:

# Install sshpass (if not available)
sudo yum install -y sshpass

# Use in scripts
sshpass -p 'password' scp file user@server:/tmp/
sshpass -p 'password' ssh user@server "sudo -S bash -c 'commands'"
Enter fullscreen mode Exit fullscreen mode

8. Best Practices

1. Keep a Backup

Always backup the original MOTD file:

# Before deployment
ssh user@server "sudo cp /etc/motd /etc/motd.backup"
Enter fullscreen mode Exit fullscreen mode

2. Use Version Control

Store banner templates in version control (Git):

git add /home/thor/nautilus_banner
git commit -m "Update security banner template"
git push
Enter fullscreen mode Exit fullscreen mode

3. Test on a Single Server First 

# Deploy to one server and verify
scp /home/thor/nautilus_banner tony@stapp01:/tmp/
ssh tony@stapp01 "sudo mv /tmp/nautilus_banner /etc/motd"

# Verify
ssh tony@stapp01 "cat /etc/motd"

# Only then deploy to others
Enter fullscreen mode Exit fullscreen mode

4. Document Changes 

# Create documentation
cat > /root/banner_deployment.log << EOF
Banner Deployment Log
======================
Date: $(date)
Deployed by: $(whoami)
Servers: stapp01, stapp02, stapp03
Template: /home/thor/nautilus_banner
Version: 1.0
SHA256: $(sha256sum /home/thor/nautilus_banner)
EOF
Enter fullscreen mode Exit fullscreen mode

5. Use Dynamic MOTD (Optional)

Consider making MOTD dynamic to show system information:

#!/bin/bash
# /etc/profile.d/motd.sh

cat << "EOF"
================================================================
   Nautilus Corporation - Production System
================================================================

System Information:
  Hostname:    $(hostname)
  IP Address:  $(hostname -I | awk '{print $1}')
  OS Version:  $(cat /etc/redhat-release)
  Uptime:      $(uptime -p)
  Load:        $(uptime | awk -F'load average:' '{print $2}')
  Memory:      $(free -h | grep Mem | awk '{print $3"/"$2}')
  Users:       $(who | wc -l)

================================================================
  Unauthorized access is prohibited. All activity is monitored.
================================================================

EOF
Enter fullscreen mode Exit fullscreen mode

6. Regular Updates

Schedule regular reviews of the security banner:

  • Quarterly: Review and update content
  • Annually: Full compliance audit
  • As needed: Update for legal requirements

9. Conclusion

Deploying a security banner across multiple Linux servers is a critical task for maintaining security compliance. By following the steps in this guide, you can efficiently deploy and manage MOTD banners across your infrastructure.

Top comments (0)