Verify User Who Owns /etc/ipsec.conf File
Ensures the /etc/ipsec.conf file is owned by the root user (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/ipsec.conf holds the Libreswan IPsec configuration: connection definitions, encryption algorithms and peer policies. If a non-root user owns it, they could weaken or disable VPN encryption, redirect a tunnel to a malicious peer, or expose traffic, undermining network confidentiality. Assigning ownership to root ensures exclusive control of the Libreswan configuration.
What Pavois checks
Pavois stats the live inode of /etc/ipsec.conf and asserts its owner is UID 0. The check is skipped on systems without Libreswan (file absent). Reading the actual filesystem metadata reflects the effective ownership the IPsec daemon relies on, not an assumed default.
only_if { file('/etc/ipsec.conf').exist? }
describe file('/etc/ipsec.conf') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u' /etc/ipsec.conf. The expected output is root 0.
Inspect & investigate
IPsec tunnel activity is logged via journalctl -u ipsec and ipsec status. To detect file tampering, set an audit watch: auditctl -w /etc/ipsec.conf -p wa -k ipsec, then review /var/log/audit/audit.log (grep for key="ipsec").
Remediation
No automated harden plan is defined for this rule yet, so it must be fixed manually: run chown root /etc/ipsec.conf to restore root ownership.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/ipsec.conf |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner can rewrite IPsec policy to weaken or hijack the VPN, exposing traffic. Fixing it is low-risk: chown root does not change any connection definition, so existing tunnels keep working. Verify no management tooling writes the file as a non-root user before applying; the change takes effect immediately, no IPsec restart required.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.