Verify User Who Owns Backup passwd File
Ensures the backup password file /etc/passwd- is owned by the root user (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/passwd- file is the backup of /etc/passwd and contains the full list of user accounts (names, UIDs, GIDs, home directories, shells). If it is not owned by root, an unprivileged user could read or tamper with account data, enabling account enumeration or privilege escalation through forged entries. Backup files are often overlooked, which makes them an easy target.
What Pavois checks
Pavois reads the effective owner of /etc/passwd- via the InSpec file resource and asserts uid == 0. The check is wrapped in only_if { file('/etc/passwd-').exist? } so it is skipped when no backup exists. Inspecting the live inode ownership reflects the real state on disk, including changes made after the file was last written by tools like passwd or useradd.
only_if { file('/etc/passwd-').exist? }
describe file('/etc/passwd-') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u' /etc/passwd-. Expected output: root 0. Alternatively ls -l /etc/passwd- should show root in the owner column.
Inspect & investigate
Ownership has no service log. Confirm the current state with stat -c '%U %u' /etc/passwd-. To trace any change, an auditd watch such as auditctl -w /etc/passwd- -p wa -k passwd-backup records writes/attribute changes in /var/log/audit/audit.log.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually: run chown root /etc/passwd- as root to set the owner to root.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/passwd- |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If misconfigured, account data in the backup can be read or altered by non-root users, aiding enumeration or privilege escalation.
Precautions before applying: chown root /etc/passwd- is non-disruptive and reversible. Verify you target the backup file (trailing -), not /etc/passwd. No service restart is required and no lockout risk exists.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.2.6, 7.1.2 | direct | per OS, see the benchmark table | high |
| NIST | AC-6 (1) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.