MEDIUM Mixed M29: System Access Controls P3
Verified on cnfdt16 OCP 4.22. RHCOS node checks (securetty, audit trail) PASS. OCP platform checks (banner-or-login-template-set, openshift-motd-exists) still FAIL — require per-deployment configuration.
Overview
Miscellaneous system access hardening: sets a legal login banner, ensures log rotation is active, disables the emergency debug shell, and restricts tmux in login shells.
Profile: NIST 800-53 Moderate (rhcos4-moderate)
Compliance Checks
| Check | Description |
|---|---|
Login banner |
Set /etc/issue legal notice banner |
Log rotation |
Ensure logrotate is activated |
Debug shell |
Disable debug-shell.service |
tmux restriction |
Prevent tmux in login shells |
Verification
oc debug node/<node> -- chroot /host bash -c 'cat /etc/issue; systemctl is-enabled debug-shell.service'