Verify Group Who Owns SSH Server Configuration Files
Ensures the /etc/ssh/sshd_config.d drop-in directory is group-owned by root (GID 0) so only the root group can add SSH configuration snippets.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/ssh/sshd_config.d directory holds drop-in snippets that are merged into the effective SSH daemon configuration via Include. A drop-in can override any directive from the main file, so a non-root group owning this directory could add a snippet that re-enables root or password login. Setting the group to root (GID 0) ensures only the root group can introduce drop-ins.
What Pavois checks
Pavois reads the resolved numeric GID of /etc/ssh/sshd_config.d via the InSpec file resource and asserts it equals 0. Because the effective SSH config is the merge of the main file plus these drop-ins, securing the directory's ownership is essential, a file-only scan of sshd_config alone would miss the drop-in path entirely.
only_if { file('/etc/ssh/sshd_config.d').exist? }
describe file('/etc/ssh/sshd_config.d') do
its('gid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%g %G' /etc/ssh/sshd_config.d. The expected output is:
0 root
List it with ls -ld /etc/ssh/sshd_config.d and confirm the merged result with sshd -T | head.
Inspect & investigate
Changes to drop-ins take effect at daemon restart: check journalctl -u ssh and /var/log/auth.log. To trace ownership or content edits, add an auditd watch (auditctl -w /etc/ssh/sshd_config.d -p wa -k sshd_conf) and grep /var/log/audit/audit.log for key="sshd_conf".
Remediation
This rule has no automated harden plan in Pavois. Apply it manually by setting the directory group to root: chgrp root /etc/ssh/sshd_config.d (add -R to include existing snippets).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /etc/ssh/sshd_config.d |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If a non-root group owns the drop-in directory, its members could plant a snippet that overrides the hardened main config and reopens remote access, exactly the kind of bypass file-based scanners miss. Correcting group ownership is non-disruptive. Precaution: after changing ownership, run sshd -t to validate the merged config before restarting ssh, so a stray drop-in does not lock you out.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.1.1 | direct | per OS, see the benchmark table | high |
| NIST | AC-17(a), AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.