用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ubuntu1804-v220-1-8-2命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-ubuntu1804-v220-1-8-2 |
| description | Ensure GDM login banner is configured |
| category | cis-networking |
| version | 2.2.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-18.04","gdm","gnome","login-banner","dconf"] |
| cis_id | 1.8.2 |
| cis_benchmark | CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
GDM is the GNOME Display Manager which handles graphical login for GNOME based systems.
Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place.
Run the following script to verify that the text banner on the login screen is enabled and set:
#!/usr/bin/env bash
{
l_pkgoutput=""
if command -v dpkg-query > /dev/null 2>&1; then
l_pq="dpkg-query -s"
elif command -v rpm > /dev/null 2>&1; then
l_pq="rpm -q"
fi
l_pcl="gdm gdm3" # Space separated list of packages to check
for l_pn in $l_pcl; do
$l_pq "$l_pn" > /dev/null 2>&1 && l_pkgoutput="$l_pkgoutput\n - Package: \"$l_pn\" exists on the system\n - checking configuration"
done
if [ -n "$l_pkgoutput" ]; then
l_output="" l_output2=""
echo -e "$l_pkgoutput"
# Look for existing settings and set variables if they exist
l_gdmfile="$(grep -Prils '^\h*banner-message-enable\b' /etc/dconf/db/*.d)"
[ -n ];
l_gdmprofile=.
grep -Pisq ;
l_output=
l_output2=
l_lsbt=
[ -n ];
l_output=
l_output2=
grep -Pq /etc/dconf/profile/;
l_output=
l_output2=
[ -f ];
l_output=
l_output2=
l_output2=
_
-e
[ -z ];
-e
-e
[ -n ] && -e
}
Run the following script to verify that the banner message is enabled and set:
#!/usr/bin/env bash
{
l_pkgoutput=""
if command -v dpkg-query > /dev/null 2>&1; then
l_pq="dpkg-query -s"
elif command -v rpm > /dev/null 2>&1; then
l_pq="rpm -q"
fi
l_pcl="gdm gdm3" # Space separated list of packages to check
for l_pn in $l_pcl; do
$l_pq "$l_pn" > /dev/null 2>&1 && l_pkgoutput="$l_pkgoutput\n - Package: \"$l_pn\" exists on the system\n - checking configuration"
done
if [ -n "$l_pkgoutput" ]; then
l_gdmprofile="gdm" # Set this to desired profile name IaW Local site policy
l_bmessage="'Authorized uses only. All activity may be monitored and reported'" # Set to desired banner message
if [ ! -f "/etc/dconf/profile/$l_gdmprofile" ]; then
echo "Creating profile \"$l_gdmprofile\""
echo -e "user-db:user\nsystem-db:$l_gdmprofile\nfile-db:/usr/share/$l_gdmprofile/greeter-dconf-defaults" > /etc/dconf/profile/$l_gdmprofile
fi
if [ ! -d "/etc/dconf/db/$l_gdmprofile.d/" ]; then
echo "Creating dconf database directory \"/etc/dconf/db/$l_gdmprofile.d/\""
mkdir /etc/dconf/db/$l_gdmprofile.d/
fi
if ! grep -Piq '^\h*banner-message-enable\h*=\h*true\b' /etc/dconf/db/$l_gdmprofile.d/*; then
echo "creating gdm keyfile for machine-wide settings"
if ! grep -Piq -- '^\h*banner-message-enable\h*=\h*' /etc/dconf/db/$l_gdmprofile.d/*; then
l_kfile="/etc/dconf/db/$l_gdmprofile.d/01-banner-message"
echo -e "\n[org/gnome/login-screen]\nbanner-message-enable=true" >> "$l_kfile"
else
l_kfile="$(grep -Pil -- '^\h*banner-message-enable\h*=\h*' /etc/dconf/db/$l_gdmprofile.d/*)"
! grep -Pq '^\h*\[org\/gnome\/login-screen\]' "$l_kfile" && sed -ri 's/^\s*(banner-message-enable\s*=\s*)(\S+)/\[org\/gnome\/login-screen\]/ a\nbanner-message-enable=true' "$l_kfile"
fi
fi
if ! grep -Piq "^\h*banner-message-text=[\'\"]+\S+" "$l_kfile"; then
sed -ri "/^\s*banner-message-enable/ a\banner-message-text=$l_bmessage" "$l_kfile"
fi
dconf update
else
echo -e "\n\n - GNOME Desktop Manager isn't installed\n - Recommendation is Not Applicable\n - No remediation required\n"
fi
}
Note:
OR
Run the following command to remove the gdm3 package:
apt purge gdm3
disabled
Additional options and sections may appear in the /etc/dconf/db/gdm.d/01-banner-message file.
If a different GUI login service is in use, consult your documentation and apply an equivalent banner.
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1078, T1078.001, T1078.002, T1078.003, T1087, T1087.001, T1087.002 | TA0007 | M1028 |