An SSH login banner displays a message before or after authentication — commonly used to display legal warnings about authorized use, which can have real legal significance in unauthorized access situations.
Why Security Banners Matter
In many jurisdictions, explicitly stating that a system is for authorized use only, and that activity is monitored, strengthens legal standing when pursuing action against unauthorized access — while not a technical security control itself, it's a meaningful legal/deterrent measure worth considering, particularly for business/organizational systems.
Important Disclaimer
This article covers technical implementation, not legal advice about the specific wording or legal effect of such banners in your jurisdiction — consult legal counsel for appropriate banner language for your specific organizational context if this matters for your use case.
Step 1 — Create Your Banner Message
sudo nano /etc/issue.net***************************************************************
This system is for authorized use only. All activity is logged
and monitored. Unauthorized access is prohibited and may be
subject to legal action.
***************************************************************Step 2 — Configure SSH to Display the Banner
sudo nano /etc/ssh/sshd_configBanner /etc/issue.netStep 3 — Restart SSH
sudo systemctl restart sshdStep 4 — Test
ssh youruser@YOUR_SERVER_IPThe banner should display before the login prompt.
Pre-Login vs Post-Login Banners
Banner displays before authentication; a separate Message of the Day (MOTD, via /etc/motd) displays after successful login — both can be used together, serving somewhat different purposes (warning before access vs informational message after).
Configuring a Post-Login MOTD
sudo nano /etc/motdUseful for displaying system information, reminders, or additional context to legitimately authenticated users after they've logged in.
Keeping the Banner Concise but Clear
An effective banner clearly states: the system is for authorized use only, activity is monitored/logged, and unauthorized access may have consequences — avoid overly long text that users will simply ignore.
This Is a Legal/Deterrent Measure, Not a Technical Security Control
A banner doesn't prevent unauthorized access technically — it's a legal and deterrent measure that complements, but doesn't replace, genuine technical security controls (SSH hardening, firewall, 2FA, and the other measures covered throughout this category).
Relevance for Compliance
Some compliance frameworks or organizational policies specifically require system access banners — check whether this applies to your specific situation (see relevant guides in the Compliance & Industry-Specific Hosting category if applicable).
Common Errors
Banner doesn't appear despite configuration — verify the Banner directive path in sshd_config exactly matches your actual banner file location, and confirm SSH was properly restarted after the configuration change.
Continue Reading
- SSH Hardening: Change the Port, Disable Root Login & Use SSH Keys
- How to Set Up Audit Logging for Compliance Requirements
- How to Monitor Auth Logs and Detect Intrusion Attempts on a Linux VPS
Browse more articles in Server Security & Hardening.
