Accounts (home dirs): 6 controls for Linux hardening

Pavois audits 6 controls in the Accounts (home dirs) hardening domain, across 9 systems and 2 standards (CIS, ANSSI BP-028). Every control declares the evidence it gathers, its severity, its remediation and its standard references.

The domain in figures

Controls	6
Severities	medium 6
Evidence gathered	filesystem state 5inventory state 1
Standards	CISANSSI BP-028
Systems	Debian 12Debian 13FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8RHEL 9 / Rocky 9 / AlmaLinux 9Ubuntu 22.04Ubuntu 24.04Ubuntu 26.04
Coverage depth	in depth

What does Pavois check in this domain?

filesystem state 5: Checked against a path’s metadata, mode, owner, group, SUID/SGID.
inventory state 1: Checked against what is installed or registered, packages present/absent, account databases.

Which standards does this domain cover?

One effective-configuration check serves as evidence for several standards at once. The references below are the ones the corpus actually carries, never a claimed equivalence. how to read a standard mapping.

CIS: 7.2.8, 7.2.9, 7.2.10
ANSSI BP-028: R50

The 6 controls of the Accounts (home dirs) domain

Ref	Rule	Sev.	OS	Standards
SOCLE-CLD-IAM-010	All Interactive Users Home Directories Must Exist	medium	9	cis
SOCLE-CLD-IAM-013	All User Files and Directories In The Home Directory Must Be Group-Owned By The Primary Group	medium	9	bp28
SOCLE-CLD-IAM-014	All User Files and Directories In The Home Directory Must Have a Valid Owner	medium	9	bp28
SOCLE-CLD-IAM-015	All User Files and Directories In The Home Directory Must Have Mode 0750 Or Less Permissive	medium	9	bp28
SOCLE-CLD-IAM-011	User Initialization Files Must Be Group-Owned By The Primary Group	medium	9	bp28cis
SOCLE-CLD-IAM-012	User Initialization Files Must Be Owned By the Primary User	medium	9	bp28cis

Full control catalogue · All control domains