Verify Group Who Owns /etc/shells File
Ensures the trusted-shells list /etc/shells is owned by group root (gid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/shells file lists the full pathnames of the login shells trusted on the system. It is consulted by chsh, FTP daemons and other programs to decide whether an account may log in interactively. If it is group-owned by a non-privileged group, an attacker could add a rogue interpreter (e.g. a wrapper that grants extra access) and turn it into a trusted login shell. Owning it by group root (gid 0) prevents unauthorized edits.
What Pavois checks
Pavois reads the real group id of /etc/shells via InSpec's file resource and asserts gid == 0. Because it checks the effective filesystem ownership rather than what a config-management template claims, it detects drift introduced after the last deployment (manual chgrp, an unpacked tarball, a package that reset the group).
only_if { file('/etc/shells').exist? }
describe file('/etc/shells') do
its('gid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%G %g' /etc/shells. Expected output: root 0.
Inspect & investigate
Not logged by default. Add an auditd watch, auditctl -w /etc/shells -p wa -k system-locale, then changes appear in /var/log/audit/audit.log (filter with grep '/etc/shells' /var/log/audit/audit.log).
Remediation
No automated remediation is wired for this rule, so it must be applied manually: chgrp 0 /etc/shells. Re-run pavois harden verify afterwards.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /etc/shells |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A loosely-owned /etc/shells lets an attacker register a malicious login shell. Resetting the group to root is safe: the file is world-readable and only needs root to write. No service or login flow breaks. Precaution: keep its mode at 0644 so programs that consult it (FTP, chsh) can still read it.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
| CIS | 7.1.9 | direct | per OS, see the benchmark table | high |
| NIST | AC-3, MP-2 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.