Verify User Who Owns Backup group File
Ensures the /etc/group- backup file is owned by root (uid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/group- is the backup copy of /etc/group and lists every group configured on the system. If it is not owned by root (uid 0), an unauthorized user could read group membership (mapping privilege relationships) or tamper with the backup to seed a later restore. Root ownership is essential to keep group definitions trustworthy.
What Pavois checks
Pavois reads the file's effective owning uid with the InSpec file resource and asserts it equals 0 (root), only when the file exists. Reading the actual filesystem owner reflects the protection currently enforced, catching chown drift, rather than assuming the default created by passwd/groupadd was preserved.
only_if { file('/etc/group-').exist? }
describe file('/etc/group-') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U' /etc/group-. Expected output: root. Alternatively ls -l /etc/group- should show root in the owner column.
Inspect & investigate
Ownership is shown by ls -l /etc/group- and stat /etc/group-. The backup is rewritten whenever group databases change (groupadd, groupmod, gpasswd). If auditd watches /etc/group- (a common identity-file watch), chown and write events appear in /var/log/audit/audit.log.
Remediation
No automated harden plan is shipped for this rule, so it must be remediated manually: run chown root /etc/group- (commonly paired with chgrp root and chmod 644 to match /etc/group).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/group- |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Non-root ownership exposes the group database backup to reading or tampering, weakening identity integrity and aiding privilege mapping. Restoring root ownership has no operational impact, only administrative tooling touches this file. Precaution: if /etc/group- is absent (no group change has occurred yet) the check is skipped; simply re-run after the first group modification.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.2.6, 7.1.4 | direct | per OS, see the benchmark table | high |
| NIST | AC-6 (1) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.