Verify Group Who Owns /etc/security/opasswd File
Ensures the password-history file /etc/security/opasswd is group-owned by root (GID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/security/opasswd stores the history of previous password hashes used by pam_pwhistory/pam_unix to enforce the password-reuse policy. The hashes it contains are crackable offline; if a non-root group could read it, those old hashes (often reused or rotated) could be attacked. Group ownership by root (GID 0) keeps this history confidential and tamper-proof.
What Pavois checks
Pavois reads the effective group ID of /etc/security/opasswd via the InSpec file resource and asserts gid == 0, skipping the rule (via only_if) where password history is not in use. Reading the live inode reflects the file's real protection now, important because PAM creates this file on first password change, after the package manifest was written.
only_if { file('/etc/security/opasswd').exist? }
describe file('/etc/security/opasswd') do
its('gid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%G %g' /etc/security/opasswd. Expected output: root 0.
Inspect & investigate
No service log records this file's ownership; confirm with stat -c '%n %U %G' /etc/security/opasswd. Password-history enforcement itself is logged by PAM in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL) at password change.
Remediation
No automated remediation plan is defined, so apply it manually: chgrp 0 /etc/security/opasswd (or chgrp root /etc/security/opasswd).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /etc/security/opasswd |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Setting the group to root is safe and does not affect PAM, which accesses the file as root, no service restart, no lockout risk. Precaution: keep the mode restrictive (0600) alongside ownership so the old hashes stay unreadable to regular users; verify the file is a regular file before chgrp.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 7.1.10 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.