Verify Group Ownership of Message of the Day Banner
Ensures /etc/motd (message-of-the-day banner) is group-owned by GID 0 (root).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/motd is the message-of-the-day shown after a successful login; it often carries approved use-notification or policy text. If it is group-owned by a non-root group (GID ≠ 0), unprivileged users could rewrite the banner, removing mandated notices or inserting misleading content. Root group ownership ensures only root can change it.
What Pavois checks
Pavois asks the file resource for the resolved numeric gid of /etc/motd and requires it to be 0. The check is skipped if the file is absent. Reading the file's effective group ownership directly (the kernel-resolved gid) is exact and avoids name-resolution ambiguity.
only_if { file('/etc/motd').exist? }
describe file('/etc/motd') do
its('gid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%G %g' /etc/motd. Expected: group root and gid 0. ls -l /etc/motd shows the group in the owner column.
Inspect & investigate
- Inspect ownership:
stat -c '%U %G %a' /etc/motdorls -l /etc/motd. - View the banner content:
cat /etc/motd. - If auditd watches the file, changes appear in
/var/log/audit/audit.log.
Remediation
No automated remediation is shipped for this rule. Fix it manually with chgrp 0 /etc/motd (or chgrp root /etc/motd) to restore root group ownership, then re-run the scan.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /etc/motd |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Wrong group ownership lets unprivileged users rewrite the post-login banner, a compliance/integrity gap rather than a direct breach. The chgrp fix is trivial and safe; note that on some systems /etc/motd is regenerated dynamically (pam_motd / update-motd), so verify your ownership change is not overwritten by a generator.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.6.4, 1.7.4 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.