Verify Group Who Owns /etc/sysconfig/sshd File
Ensures the SSH daemon environment file /etc/sysconfig/sshd is owned by group root (gid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
On RHEL-family systems /etc/sysconfig/sshd holds environment options and command-line flags passed to the SSH daemon at start-up (for example crypto-policy overrides). If a non-privileged group owns it, an attacker could be granted write access and weaken the daemon's launch parameters, disabling FIPS mode, loosening ciphers, or pointing it at a rogue config. Group ownership by root (gid 0) protects these start-up settings.
What Pavois checks
Pavois reads the real group id of /etc/sysconfig/sshd via InSpec's file resource and asserts gid == 0. It checks the effective ownership on disk, so drift from a manual chgrp or a package update is caught even when a config-management tool believes the file is correct.
only_if { file('/etc/sysconfig/sshd').exist? }
describe file('/etc/sysconfig/sshd') do
its('gid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%G %g' /etc/sysconfig/sshd. Expected output: root 0.
Inspect & investigate
Ownership changes are visible with an auditd watch (auditctl -w /etc/sysconfig/sshd -p wa -k sshd_config) in /var/log/audit/audit.log. SSH daemon start-up using these options is logged via journalctl -u sshd.
Remediation
No automated remediation is wired for this rule, so it must be applied manually: chgrp 0 /etc/sysconfig/sshd. Re-run pavois harden verify afterwards.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /etc/sysconfig/sshd |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Weak ownership of this file can let an attacker tamper with how sshd is launched. Resetting the group to root is safe, the file is read by the SSH init/systemd unit running as root. No login session is affected. Precaution: keep the mode at 0640/0600; if you edit the file, restart with systemctl restart sshd and keep an existing SSH session open until you confirm the new daemon accepts connections.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.1.3 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.