Verify Group Who Owns Backup gshadow File
Ensures /etc/gshadow-, the backup copy of /etc/gshadow (group password hashes), is group-owned by root (gid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/gshadow- is the backup of /etc/gshadow and contains group password hashes. If its group owner is not root (gid 0), an unprivileged group could read those hashes and attempt offline cracking to gain group membership, or tamper with the backup so a later restore weakens the live file. This is one of the most sensitive files on the system.
What Pavois checks
Pavois reads the effective ownership of /etc/gshadow- from the inode (via stat) and asserts gid == 0. Checking the live inode catches drift from manual restores or backup tooling instead of trusting a template. The only_if guard skips the check when the backup is absent.
only_if { file('/etc/gshadow-').exist? }
describe file('/etc/gshadow-') do
its('gid') { should eq 42 }
endHow to verify it is applied
Run stat -c '%G %g' /etc/gshadow-. Expected output: root 0. If the backup file does not exist the control is skipped.
Inspect & investigate
Ownership changes are not logged by default. Inspect with ls -l /etc/gshadow- or stat /etc/gshadow-. With an auditd watch (auditctl -w /etc/gshadow- -p wa), chown events appear in /var/log/audit/audit.log.
Remediation
No automated harden plan is defined for this rule yet, so it must be applied manually: run chgrp root /etc/gshadow- (or chown :root /etc/gshadow-) to restore the root group owner. Consider also tightening its mode to 0000.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | shadow |
|---|---|
| path | /etc/gshadow- |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A wrong group owner on /etc/gshadow- can expose group password hashes to unprivileged users, enabling offline cracking. Precautions: restoring root group ownership is safe, the backup file is not used by running services, and does not affect group authentication. Verify no backup tool recreates it with broader ownership.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 7.1.8 | direct | per OS, see the benchmark table | high |
| NIST | AC-6 (1) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.