Verify Group Who Owns /etc/security/opasswd.old File
Ensures the password-history backup /etc/security/opasswd.old is group-owned by root (GID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/security/opasswd.old is the backup of the password-history file that PAM writes before updating /etc/security/opasswd. It holds the same crackable old password hashes. If a non-root group could read it, that secondary copy would leak the same sensitive material the primary file protects. Group ownership by root (GID 0) keeps the backup confidential and tamper-proof.
What Pavois checks
Pavois reads the effective group ID of /etc/security/opasswd.old via the InSpec file resource and asserts gid == 0, skipping it (via only_if) when the backup does not exist. Reading the live inode is what proves the backup is protected right now, PAM re-creates it on each password change, so an install-time manifest cannot vouch for its current owner.
only_if { file('/etc/security/opasswd.old').exist? }
describe file('/etc/security/opasswd.old') do
its('gid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%G %g' /etc/security/opasswd.old. Expected output: root 0.
Inspect & investigate
No service log records this file's ownership; confirm with stat -c '%n %U %G' /etc/security/opasswd.old. The password change that produces the backup is logged by PAM in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL).
Remediation
No automated remediation plan is defined, so apply it manually: chgrp 0 /etc/security/opasswd.old (or chgrp root /etc/security/opasswd.old).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /etc/security/opasswd.old |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Setting the group to root is safe and does not affect PAM, which accesses the file as root, no service restart, no lockout risk. Precaution: keep the mode restrictive (0600) alongside ownership; if the backup is no longer needed, removing it is also acceptable, but never make it group/world-readable.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 7.1.10 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.