Verify Group Who Owns /var/log/secure File
Ensures the /var/log/secure authentication log is owned by the adm group.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /var/log/secure file records authentication and authorization activity (logins, sudo, PAM, SSH). Because it can reveal usernames, source IPs, failed-login patterns and privilege-escalation attempts, it must be restricted to the adm group so only authorized personnel can read it. Unrestricted access leaks attack-surface intelligence and lets an intruder cover their tracks.
What Pavois checks
Pavois reads the file's effective owning group with the InSpec file resource and asserts it is adm, only when the file exists. Reading live filesystem metadata reflects the permissions the kernel enforces right now, catching drift from log rotation or manual chgrp that a static config/package scan would miss.
only_if { file('/var/log/secure').exist? }
describe file('/var/log/secure') do
its('group') { should eq 'adm' }
endHow to verify it is applied
Run stat -c '%G' /var/log/secure. Expected output: adm. Alternatively ls -l /var/log/secure should show adm in the group column.
Inspect & investigate
Ownership is shown by ls -l /var/log/secure and stat /var/log/secure. The file's own content is the authentication log (logins, sudo, SSH); on Debian/Ubuntu the equivalent is often /var/log/auth.log and journalctl -u ssh. If auditd watches /var/log, ownership-change syscalls appear in /var/log/audit/audit.log.
Remediation
Pavois's harden plan uses the file resource to set the owning group of /var/log/secure to adm (equivalent to chgrp adm /var/log/secure). Apply it with pavois harden apply; no service restart is required.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | adm |
|---|---|
| path | /var/log/secure |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A wrong group lets unprivileged users read authentication records, a direct path to credential reconnaissance and log tampering. Setting the group to adm is low-risk since log writers run as root. Precaution: ensure log-shipping/SIEM agents either run as root or are members of adm; otherwise add them to adm before applying so they keep read access.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.