← All rules
SOCLE-CLD-FSP-037// File ownershipmediumfilesystem state

Verify Group Who Owns SSH Server config file

Ensures /etc/ssh/sshd_config is group-owned by root (GID 0) so only the root group can modify the SSH daemon's configuration.

Checked against a path’s metadata, mode, owner, group, SUID/SGID.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 3 standards

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

/etc/ssh/sshd_config controls every security feature of the SSH daemon, authentication methods, root login, ciphers, port. If a non-root group owns it, an account in that group could weaken these settings (for example re-enabling password or root login) and open a remote foothold. Setting the group to root (GID 0) ensures only the most privileged group can alter the daemon's configuration.

What Pavois checks

Pavois reads the resolved numeric GID of /etc/ssh/sshd_config via the InSpec file resource and asserts it equals 0. It checks the live inode metadata at audit time, so the result reflects the file's actual ownership rather than a packaging default or a documented expectation.

only_if { file('/etc/ssh/sshd_config').exist? }
describe file('/etc/ssh/sshd_config') do
  its('gid') { should eq 0 }
end

How to verify it is applied

Run stat -c '%g %G' /etc/ssh/sshd_config. The expected output is:

  • 0 root

List it with ls -l /etc/ssh/sshd_config to confirm the group column shows root.

Inspect & investigate

SSH config changes surface when the daemon restarts: check journalctl -u ssh (or journalctl -u sshd on RHEL-family) and /var/log/auth.log. To trace ownership edits, add an auditd watch (auditctl -w /etc/ssh/sshd_config -p wa -k sshd_conf) and grep /var/log/audit/audit.log for key="sshd_conf".

Remediation

This rule has no automated harden plan in Pavois. Apply it manually by setting the group to root: chgrp root /etc/ssh/sshd_config (or chown :root /etc/ssh/sshd_config).

Pavois applies this with its own harden engine, the plan below, not a shell script:

grouproot
path/etc/ssh/sshd_config
resourcefile
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

If the wrong group owns this file, members of that group could quietly relax SSH hardening and create a remote-access backdoor. Fixing it only changes group ownership and does not alter the daemon's behavior, so there is no service disruption. Precaution: ensure no legitimate automation edits sshd_config under a non-root group; after correcting ownership, validate the config with sshd -t before restarting the daemon to avoid locking yourself out.

Standards mapping

StandardReferenceTypeVersionConfidence
ANSSI BP-028R50direct2.0high
CIS5.1.1, 5.1.2directper OS, see the benchmark tablehigh
NISTAC-17(a), AC-6(1), CM-6(a)supporting800-53 Rev 5 · 800-171 Rev 2 (pinned)medium

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references