topic Re: R80.30 set message banner fails in Firewall and Security Management

R80.30 set message banner fails

Carsten_Weber — Wed, 22 Jan 2020 21:16:13 GMT

Hello everyone,

I just tried to set a multiline message banner as I used to do in R77.30 (which did not change in R80.30) but could not:

~~~~~~~~~~~~~~~~~~~~~~~~
openserver> show message banner
Banner message: This system is for authorized use only.

openserver> delete message banner

openserver> set message banner on line msgvalue "Only authorized personnel is allowed to connect to the server"
openserver> set message banner on line msgvalue "Access is monitored"
openserver> set message banner on line msgvalue "Additional laws and regulations may apply"

openserver> show message banner
Banner message: This system is for authorized use only.
~~~~~~~~~~~~~~~~~~~~~~~~

The same in the WebUI:

GAiA WebUI

Does anyone have a clue what might be causing this?

Best regards

Carsten

Re: R80.30 set message banner fails

G_W_Albrecht — Thu, 23 Jan 2020 12:30:36 GMT

Max line length: 80 chars

Max Banner lenght: 143 chars

The old 155 chars limit has been lifted according to sk83140: Banner messages in SecurePlatform, Gaia, and IPSO:

Starting in Gaia R75.45, limits for Banner Message were increased:

from 3 lines, 50 characters per line, 150 characters total to 0 lines, 80 characters per line, 1600 characters total !

but it seems that R80.30 has similar restrictions again...

Re: R80.30 set message banner fails

Carsten_Weber — Fri, 21 Feb 2020 10:16:26 GMT

Ok, "0 lines" is indeed less than my 3 lines 😉

(You meant to write "20 lines")

I checked and I was well under 80 charcters. Also the clish does not mention that specific characters (like "#") are no longer allowed among others! The GAiA WebUI suddenly does tell me that, as long as I do not break the untold "40 characters"-law of the 3rd line (explained below). This might be checked before checking for special characters. This "not allowed characters check" does not trigger, even when starting with a "#" as a first character in line 1!

I played around a little bit and in GAiA WebUI and I tested until the following last line and letter...in that line the error popup message does not occur (all together 126 characters in all lines):

This worked (with only 40 characters in line3, but I can add more text in the first 2 lines without any negative impact):
~~~~~~~~~~~~~~~~~~~~~~~~

Only authorized personnel is allowed to connect to the server.
Access is monitored.
Additional laws and regulations may appl
~~~~~~~~~~~~~~~~~~~~~~~~

But yet, the new message does not show in the GAiA clish, using the command "show message banner" only when "using show configuration message"
~~~~~~~~~~~~~~~~~~~~~~~~
MLM> show message banner

Banner message: This system is for authorized use only.

After applying the text mentioned as working above:

~~~~~~~~~~~~~~~~~~~~~~~~
MLM> show message banner

Banner message:

~~~~~~~~~~~~~~~~~~~~~~~~
MLM> show configuration message
set message banner on

set message banner on line msgvalue "Only authorized personnel is allowed to connect to the server."
set message banner on line msgvalue "Access is monitored."
set message banner on line msgvalue "Additional laws and regulations may appl"
set message motd off

set message caption off
~~~~~~~~~~~~~~~~~~~~~~~~

When trying to log in to a system I see the text above properly.

Now, when entering the last letter "y" I get the following:
A new error message

WTF?

Sorry if the above is a bit confusing. The "message banner" seems to be seriously broken in R80.30 .

Re: R80.30 set message banner fails

G_W_Albrecht — Thu, 23 Jan 2020 14:58:26 GMT

Yes, it is 20, not 0 lines in sk83140. But while to call it broken is ok, i see not relevant gain in using it - i would prefer not to use this banner at all (and i have disabled it everywhere i could). Legacy, old school, only for granny an grandad...

Re: R80.30 set message banner fails

Carsten_Weber — Thu, 23 Jan 2020 15:47:58 GMT

...and for Auditors 😐

Re: R80.30 set message banner fails

Carsten_Weber — Wed, 26 Feb 2020 14:32:35 GMT

Ok, it was a layer 8 problem 😳
My bad entirely!

What I wanted to do, but then forgot before copying was to compare the old file structure with the new one in regards to sk99134.

In R77.30 we followed this article:
sk99134 - How to add logging for Bash shell commands in Gaia / SecurePlatform OS

Editing the following files:
/etc/bashrc
/etc/cli.sh
/etc/profile
/etc/sudoers
/etc/security/pam_env.conf

I used those from R77.30 also in R80.30 without checking (I wanted to check them, though...really!)

In R80.30 the files "sudoers" and "bashrc" have changed ever so slightly, that one of this files must have made all the difference. Restoring to the original R80.30 files "sudoers" and "bashrc" and editing them again according to sk99134 solved our issue with the message banner being implemented incorrectly.

Thanks for TACs response that triggered this chain of thought...

BR
Carsten