0

I have read from several sources that having an adequate SSH banner set may aid in prosecution of intruders in some jurisdictions. I was just wandering if there was any truth to this, and what everyone's experience with such a banner is?

If this is indeed true, what should it say? Is something like "Disconnect immediately if you are not authorized to access this server belonging to (Company) or you will be prosecuted to the fullest extent of the law." sufficient?

2

1 Answer 1

5
  1. Your law department will give you a proper response.

    The supposed story is that hackers have used the defense that "The device I was accessing said Welcome when I tried to login so I didn't know it was an issue".

  2. Ask a lawyer, or request from your manager/supervisor that they get the information from a lawyer. Your company has to have dealt with one on a somewhat regular basis.(This is assuming you have no legal department)

  3. If you don't have a legal department and no one will authorize using company money to ask a lawyer.

    • State "Authorized users only"
    • Do not state your company name in the banner/motd.
    • Don't allow external users or non-admins the ability to access your admin interfaces in the first place.

There should be one obvious thing though. When looking for legal advice, ask someone qualified to give legal advice.

Not the answer you're looking for? Browse other questions tagged .