Post History

It turns out, that Lynis test code lives in `/usr/share/lynis/include/test_banners` which gave me a way to find what banner is considered good. :-) In my case, it's to have 5 or more specific keywords.

Both banners are being shown to users logging in via SSH, locally or through the network, and yes, these are more on the legal/repudiation/audit side than actual hard defenses.

And the `\l` is a... **getty** escape sequence. And `man agetty` was the right place to search, but not for `\l` but just for `^ *l`, this yielded few hits, among them: 

    l
        Insert the name of the current tty line.