Verify Group Who Owns passwd File
Ensures the account database /etc/passwd is group-owned by root (GID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/passwd defines every user account: login name, UID, GID, home directory and shell. If a non-root group could write to it, an attacker could create accounts, change a user's UID to 0, or alter login shells, a direct path to privilege escalation. Restricting group ownership to GID 0 (root) ensures only root can modify the account database.
What Pavois checks
Pavois reads the effective group ID of /etc/passwd via the InSpec file resource and asserts gid == 0. Reading the live inode reflects the current security state, catching a chgrp slip, a bad restore, or a misbehaving user-management tool, whereas a package manifest only records the intended owner at install time.
only_if { file('/etc/passwd').exist? }
describe file('/etc/passwd') do
its('gid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%G %g' /etc/passwd. Expected output: root 0.
Inspect & investigate
No service log records this static file's ownership; confirm with stat -c '%n %U %G' /etc/passwd. If a file watch is configured, account-database changes appear in /var/log/audit/audit.log (e.g. key="identity").
Remediation
No automated remediation plan is defined, so apply it manually: chgrp 0 /etc/passwd (or chgrp root /etc/passwd).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /etc/passwd |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Resetting group ownership to root is the default and safe state, /etc/passwd must be root-owned, mode 0644, world-readable. No service restart and no lockout risk. Precaution: never accidentally make the file group-writable or change its mode while fixing ownership; verify it is a regular file (not a symlink) before chgrp.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
| CIS | 2.2.6, 7.1.1 | direct | per OS, see the benchmark table | high |
| NIST | AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.