Verify Group Who Owns SSH Server config file
Ensures /etc/ssh/sshd_config is group-owned by root (GID 0) so only the root group can modify the SSH daemon's configuration.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/ssh/sshd_config controls every security feature of the SSH daemon, authentication methods, root login, ciphers, port. If a non-root group owns it, an account in that group could weaken these settings (for example re-enabling password or root login) and open a remote foothold. Setting the group to root (GID 0) ensures only the most privileged group can alter the daemon's configuration.
What Pavois checks
Pavois reads the resolved numeric GID of /etc/ssh/sshd_config via the InSpec file resource and asserts it equals 0. It checks the live inode metadata at audit time, so the result reflects the file's actual ownership rather than a packaging default or a documented expectation.
only_if { file('/etc/ssh/sshd_config').exist? }
describe file('/etc/ssh/sshd_config') do
its('gid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%g %G' /etc/ssh/sshd_config. The expected output is:
0 root
List it with ls -l /etc/ssh/sshd_config to confirm the group column shows root.
Inspect & investigate
SSH config changes surface when the daemon restarts: check journalctl -u ssh (or journalctl -u sshd on RHEL-family) and /var/log/auth.log. To trace ownership edits, add an auditd watch (auditctl -w /etc/ssh/sshd_config -p wa -k sshd_conf) and grep /var/log/audit/audit.log for key="sshd_conf".
Remediation
This rule has no automated harden plan in Pavois. Apply it manually by setting the group to root: chgrp root /etc/ssh/sshd_config (or chown :root /etc/ssh/sshd_config).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /etc/ssh/sshd_config |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If the wrong group owns this file, members of that group could quietly relax SSH hardening and create a remote-access backdoor. Fixing it only changes group ownership and does not alter the daemon's behavior, so there is no service disruption. Precaution: ensure no legitimate automation edits sshd_config under a non-root group; after correcting ownership, validate the config with sshd -t before restarting the daemon to avoid locking yourself out.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
| CIS | 5.1.1, 5.1.2 | direct | per OS, see the benchmark table | high |
| NIST | AC-17(a), AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.