#!/usr/bin/env bash{l_pkgoutput=""ifcommand-vdpkg-query>/dev/null2>&1;thenl_pq="dpkg-query -W"elifcommand-vrpm>/dev/null2>&1;thenl_pq="rpm -q"fil_pcl="gdm gdm3"# Space seporated list of packages to checkforl_pnin$l_pcl;do$l_pq"$l_pn">/dev/null2>&1&&l_pkgoutput="$l_pkgoutput\n - Package: \"$l_pn\" exists on the system\n - checking configuration"doneif[-n"$l_pkgoutput"];thenl_output=""l_output2=""echo-e"$l_pkgoutput"# Look for existing settings and set variables if they existl_gdmfile="$(grep-Prils'^\h*banner-message-enable\b'/etc/dconf/db/*.d)"if[-n"$l_gdmfile"];then# Set profile name based on dconf db directory ({PROFILE_NAME}.d)l_gdmprofile="$(awk-F\/'{split($(NF-1),a,".");print a[1]}'<<<"$l_gdmfile")"# Check if banner message is enabledifgrep-Pisq'^\h*banner-message-enable=true\b'"$l_gdmfile";thenl_output="$l_output\n - The \"banner-message-enable\" option is enabled in \"$l_gdmfile\""elsel_output2="$l_output2\n - The \"banner-message-enable\" option is not enabled"fil_lsbt="$(grep-Pios'^\h*banner-message-text=.*$'"$l_gdmfile")"if[-n"$l_lsbt"];thenl_output="$l_output\n - The \"banner-message-text\" option is set in \"$l_gdmfile\"\n - banner-message-text is set to:\n - \"$l_lsbt\""elsel_output2="$l_output2\n - The \"banner-message-text\" option is not set"fiifgrep-Pq"^\h*system-db:$l_gdmprofile"/etc/dconf/profile/"$l_gdmprofile";thenl_output="$l_output\n - The \"$l_gdmprofile\" profile exists"elsel_output2="$l_output2\n - The \"$l_gdmprofile\" profile doesn't exist"fiif[-f"/etc/dconf/db/$l_gdmprofile"];thenl_output="$l_output\n - The \"$l_gdmprofile\" profile exists in the dconf database"elsel_output2="$l_output2\n - The \"$l_gdmprofile\" profile doesn't exist in the dconf database"fielsel_output2="$l_output2\n - The \"banner-message-enable\" option isn't configured"fielseecho-e"\n\n - GNOME Desktop Manager isn't installed\n - Recommendation is Not Applicable\n- Audit result:\n *** PASS ***\n"fi# Report results. If no failures output in l_output2, we passif[-z"$l_output2"];thenecho-e"\n- Audit Result:\n ** PASS **\n$l_output\n"elseecho-e"\n- Audit Result:\n ** FAIL **\n - Reason(s) for audit failure:\n$l_output2\n"[-n"$l_output"]&&echo-e"\n- Correctly set:\n$l_output\n"fi}
#!/usr/bin/env bash{l_pkgoutput=""ifcommand-vdpkg-query>/dev/null2>&1;thenl_pq="dpkg-query -W"elifcommand-vrpm>/dev/null2>&1;thenl_pq="rpm -q"fil_pcl="gdm gdm3"# Space seporated list of packages to checkforl_pnin$l_pcl;do$l_pq"$l_pn">/dev/null2>&1&&l_pkgoutput="$l_pkgoutput\n - Package: \"$l_pn\" exists on the system\n - checking configuration"doneif[-n"$l_pkgoutput"];thenl_gdmprofile="gdm"# Set this to desired profile name IaW Local site policyl_bmessage="'Authorized uses only. All activity may be monitored and reported'"# Set to desired banner messageif[!-f"/etc/dconf/profile/$l_gdmprofile"];thenecho"Creating profile \"$l_gdmprofile\""echo-e"user-db:user\nsystem-db:$l_gdmprofile\nfiledb:/usr/share/$l_gdmprofile/greeter-dconf-defaults">/etc/dconf/profile/$l_gdmprofilefiif[!-d"/etc/dconf/db/$l_gdmprofile.d/"];thenecho"Creating dconf database directory \"/etc/dconf/db/$l_gdmprofile.d/\""mkdir/etc/dconf/db/$l_gdmprofile.d/
fiif!grep-Piq'^\h*banner-message-enable\h*=\h*true\b'/etc/dconf/db/$l_gdmprofile.d/*;thenecho"creating gdm keyfile for machine-wide settings"if!grep-Piq--'^\h*banner-message-enable\h*=\h*'/etc/dconf/db/$l_gdmprofile.d/*;thenl_kfile="/etc/dconf/db/$l_gdmprofile.d/01-banner-message"echo-e"\n[org/gnome/login-screen]\nbanner-message-enable=true">>"$l_kfile"elsel_kfile="$(grep-Pil--'^\h*banner-message-enable\h*=\h*'/etc/dconf/db/$l_gdmprofile.d/*)"!grep-Pq'^\h*\[org\/gnome\/login-screen\]'"$l_kfile"&&sed-ri'/^\s*banner-message-enable/ i\[org/gnome/login-screen]'"$l_kfile"!grep-Pq'^\h*banner-message-enable\h*=\h*true\b'"$l_kfile"&&sed-ri's/^\s*(banner-message-enable\s*=\s*)(\S+)(\s*.*$)/\1true \3//'"$l_kfile"# sed -ri '/^\s*\[org\/gnome\/login-screen\]/ a\\nbanner-messageenable=true' "$l_kfile"fifiif!grep-Piq"^\h*banner-message-text=[\'\"]+\S+""$l_kfile";thensed-ri"/^\s*banner-message-enable/ a\banner-messagetext=$l_bmessage""$l_kfile"fidconfupdate
elseecho-e"\n\n - GNOME Desktop Manager isn't installed\n - Recommendation is Not Applicable\n - No remediation required\n"fi}
Note:
There is no character limit for the banner message. gnome-shell autodetects longer stretches of text and enters two column mode.
The banner message cannot be read from an external file.
OR
Run the following command to remove the gdm3 package: