Verify Group Who Owns /etc/ipsec.conf File
Ensures /etc/ipsec.conf is group-owned by root.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/ipsec.conf holds the Libreswan IPsec/VPN configuration. If a non-root group owns it, members of that group could alter tunnel definitions, weaken cryptography or redirect traffic. Assigning group ownership to root ensures exclusive control of the VPN configuration and prevents tampering by unprivileged users.
What Pavois checks
Pavois asks the file resource for the resolved group of /etc/ipsec.conf and requires it to be root. The check is skipped if the file does not exist (Libreswan not installed). Reading the file's effective group ownership directly from the system is exact and distro-independent.
only_if { file('/etc/ipsec.conf').exist? }
describe file('/etc/ipsec.conf') do
its('group') { should eq 'root' }
endHow to verify it is applied
Run stat -c '%G' /etc/ipsec.conf. Expected: root. ls -l /etc/ipsec.conf shows the group in the owner column.
Inspect & investigate
- Inspect ownership:
stat -c '%U %G %a' /etc/ipsec.conforls -l /etc/ipsec.conf. - Validate the VPN config still loads:
ipsec verify/systemctl status ipsec. - If auditd watches the file, changes appear in
/var/log/audit/audit.log.
Remediation
pavois harden apply uses the file resource to set the group owner of /etc/ipsec.conf to root (equivalent to chgrp root /etc/ipsec.conf). It is idempotent and applied automatically when you run pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /etc/ipsec.conf |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Wrong group ownership lets a non-root group tamper with VPN/IPsec settings, potentially weakening or rerouting encrypted traffic. The fix is a low-risk group change; since it only adjusts ownership (not content), no service restart is normally needed, but confirm the IPsec service still parses its config afterwards.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.