Verify Group Ownership of System Login Banner for Remote Connections
Ensures /etc/issue.net (remote login banner) is group-owned by GID 0 (root).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/issue.net is the pre-login banner shown for remote (network) logins, such as the text SSH/telnet display before authentication. If it is group-owned by a non-root group (GID ≠ 0), unprivileged users could alter or remove the mandated legal use-notification shown to remote users. Root group ownership ensures only root can change it.
What Pavois checks
Pavois asks the file resource for the resolved numeric gid of /etc/issue.net and requires it to be 0. The check is skipped if the file is absent. Reading the file's effective group ownership directly (the kernel-resolved gid) is exact and distro-independent.
only_if { file('/etc/issue.net').exist? }
describe file('/etc/issue.net') do
its('gid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%G %g' /etc/issue.net. Expected: group root and gid 0. ls -l /etc/issue.net shows the group in the owner column.
Inspect & investigate
- Inspect ownership:
stat -c '%U %G %a' /etc/issue.netorls -l /etc/issue.net. - View the banner content:
cat /etc/issue.net. - If auditd watches the file, changes appear in
/var/log/audit/audit.log.
Remediation
No automated remediation is shipped for this rule. Fix it manually with chgrp 0 /etc/issue.net (or chgrp root /etc/issue.net) to restore root group ownership, then re-run the scan.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /etc/issue.net |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Wrong group ownership lets unprivileged users tamper with the remote login banner, a compliance/legal-notice gap rather than a direct breach. The chgrp fix is trivial and safe; it changes only who may edit the file, not the banner text or how SSH displays it.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.2.8, 1.6.6, 1.7.6 | direct | per OS, see the benchmark table | high |
| PCI DSS | 1.2.8 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.