Linux安全基线整改实践：修复 Business Use Notice MOTD ISSUE Existence 检查项

目录一、背景二、问题分析三、排查过程四、修复方案五、验证修复结果六、自动化修复脚本七、风险评估八、总结一、背景在企业 Linux 安全基线扫描过程中发现服务器存在如下基线告警Category: Business Use Notice Name: Business Use Notice MOTD/ISSUE Existence LINUX-MULTI Severity: Medium该检查项属于系统登录告警Login Banner类安全基线要求主要用于提醒用户服务器属于企业资产未经授权禁止访问同时告知用户操作行为可能被监控和审计。虽然该问题不会影响业务运行但会导致安全基线检查不通过生产环境合规检查失败安全审计要求不满足因此需要进行整改。二、问题分析Linux 系统通常通过以下两个文件向用户展示告警信息/etc/motd/etc/issue其中/etc/motd—— 表示用户登录成功后显示的提示信息Message Of The Day/etc/issue—— 表示用户登录前显示的提示信息安全基线通常要求上述文件存在并包含企业规定的告警内容。三、排查过程首先选择已通过基线检查的标准服务器进行对比。查看 MOTDcat/etc/motd发现内容如下----------------------Warning----------------------- Authorized access only This system is the property of Company Disconnect IMMEDIATELY if you are not an authorized user Your IP has been recorded. Do not damage any files! ----------------------------------------------------查看 ISSUEcat/etc/issue返回\S Kernel \r on \m说明标准环境中MOTD 存在企业告警信息 ISSUE 文件存在而问题服务器缺少对应内容因此被安全扫描工具识别为Business Use Notice MOTD/ISSUE Existence不符合要求。四、修复方案4.1 配置登录后告警信息MOTD编辑vi/etc/motd配置如下内容----------------------Warning----------------------- Authorized access only This system is the property of Company Disconnect IMMEDIATELY if you are not an authorized user Your IP has been recorded. Do not damage any files! ----------------------------------------------------4.2 配置登录前提示信息ISSUE编辑vi/etc/issue配置\S Kernel \r on \m说明\S 代表系统名称 \r 代表内核版本 \m 代表硬件架构系统登录前会自动显示实际内容。五、验证修复结果验证 MOTDcat/etc/motd应显示----------------------Warning----------------------- Authorized access only This system is the property of Company Disconnect IMMEDIATELY if you are not an authorized user Your IP has been recorded. Do not damage any files! ----------------------------------------------------验证 ISSUEcat/etc/issue返回\S Kernel \r on \m检查文件存在ls-l/etc/motdls-l/etc/issue确认文件正常创建即可。六、自动化修复脚本对于多台服务器批量整改可封装 Shell 脚本。6.1 fix_motd_issue.sh#!/bin/bashcat/etc/motdEOF ----------------------Warning----------------------- Authorized access only This system is the property of Company Disconnect IMMEDIATELY if you are not an authorized user Your IP has been recorded. Do not damage any files! ---------------------------------------------------- EOFcat/etc/issueEOF \S Kernel \r on \m EOFecho /etc/motd cat/etc/motdechoecho /etc/issue cat/etc/issue授权chmodx fix_motd_issue.sh执行./fix_motd_issue.sh七、风险评估本次整改仅涉及两个文本文件/etc/motd/etc/issue不会影响SSH 登录Web 服务数据库服务应用服务网络配置业务访问无需执行reboot无需执行systemctl restart sshd修改后立即生效。八、总结本次问题属于 Linux 登录告警信息缺失导致的安全基线不符合项。通过补充/etc/motd和/etc/issue标准登录提示信息即可满足Business Use Notice Business Use Notice MOTD/ISSUE Existence LINUX-MULTI检查要求。该整改方案简单、安全、无业务影响非常适合作为 Linux 安全基线标准化脚本的一部分进行批量实施。