WN25-SH-000020 Windows Server 2025 OpenSSH must display the Standard Mandatory DoW Notice and Consent Banner before granting remote access to the system via an OpenSSH logon.
All changes in this version
Maps to AC-8 via CCI-000048, CCI-001384, CCI-001385, CCI-001386, CCI-001387, CCI-001388
Title
Windows Server 2025 OpenSSH must display the Standard Mandatory DoW Notice and Consent Banner before granting remote access to the system via an OpenSSH logon.
Control
If OpenSSH is not installed on the system, this requirement is not applicable. Verify any SSH connection to the system displays the Standard Mandatory DoW Notice and Consent Banner before granting access to the system. Check for the location of the banner file being used with the following command: C:\ > Get-Content "$env:ProgramData\ssh\sshd_config" | Select-String -Pattern '^\s*Banner' Banner C:\ProgramData\ssh\Banner.txt If "Banner" is set to "none", the line is commented out, or the line is missing, this is a finding.
Discussion
The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious must ensure usage of a banner that does not provide easy attribution. Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00089
Related controls
CCI-000048, CCI-001384, CCI-001385, CCI-001386, CCI-001387, CCI-001388
Fix
To configure the system, add or modify the following line in the "$env:ProgramData/ssh/sshd_config" file. An example configuration line is: Banner C:\ProgramData\ssh\Banner.txt Restart the OpenSSH service for the settings to take effect.