Verify Group Who Owns Backup group File
Ensures /etc/group-, the backup copy of /etc/group, is group-owned by root (gid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/group- is the backup of /etc/group automatically written by tools like useradd/groupadd. It holds the same group membership data, including which accounts belong to privileged groups. If its group owner is not root (gid 0), an unprivileged group could read it to enumerate the system's group structure or tamper with the backup, which may later be restored over the live file.
What Pavois checks
Pavois reads the effective ownership of /etc/group- from the inode (via stat) and asserts gid == 0. Reading the live state catches drift introduced by manual restores or backup tools, rather than trusting a configuration template. The only_if guard skips the check on systems where the backup has not yet been created.
only_if { file('/etc/group-').exist? }
describe file('/etc/group-') do
its('gid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%G %g' /etc/group-. Expected output: root 0. If the backup file does not exist the control is skipped.
Inspect & investigate
Ownership changes are not logged by default. Inspect with ls -l /etc/group- or stat /etc/group-. With an auditd watch (auditctl -w /etc/group- -p wa), chown events appear in /var/log/audit/audit.log.
Remediation
No automated harden plan is defined for this rule yet, so it must be applied manually: run chgrp root /etc/group- (or chown :root /etc/group-) to restore the root group owner.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /etc/group- |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A wrong group owner on /etc/group- exposes group membership data and a restorable backup to unprivileged users. Precautions: restoring root group ownership is safe and has no functional effect on running services, /etc/group- is only consulted during account-management operations. Verify no backup tool will recreate it with the wrong ownership.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.2.6, 7.1.4 | direct | per OS, see the benchmark table | high |
| NIST | AC-6 (1) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.