Verify User Who Owns /etc/ipsec.secrets File
Ensures the /etc/ipsec.secrets file is owned by the root user (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/ipsec.secrets stores the Libreswan IPsec authentication secrets: pre-shared keys (PSK) and private RSA/ECDSA keys. If a non-root user owns it, they could read these secrets to impersonate the VPN endpoint or decrypt captured traffic, or replace them to hijack tunnels. Assigning ownership to root ensures exclusive control of the Libreswan secrets and is critical for system security.
What Pavois checks
Pavois stats the live inode of /etc/ipsec.secrets and asserts its owner is UID 0. The check is skipped on systems without Libreswan (file absent). Reading the actual filesystem metadata reflects the effective ownership the IPsec daemon relies on for authentication, not an assumed default.
only_if { file('/etc/ipsec.secrets').exist? }
describe file('/etc/ipsec.secrets') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u' /etc/ipsec.secrets. The expected output is root 0.
Inspect & investigate
IPsec authentication activity is logged via journalctl -u ipsec and ipsec status. To detect file tampering, set an audit watch: auditctl -w /etc/ipsec.secrets -p wa -k ipsec, then review /var/log/audit/audit.log (grep for key="ipsec").
Remediation
No automated harden plan is defined for this rule yet, so it must be fixed manually: run chown root /etc/ipsec.secrets to restore root ownership.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/ipsec.secrets |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner can read the VPN's PSKs and private keys, enabling endpoint impersonation and traffic decryption. Fixing it is low-risk: chown root does not change the secrets, so authentication keeps working. Pair with strict permissions (chmod 600) so the keys are not readable by other users; the change applies immediately, no restart required.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.