Verify ownership of System Login Banner for Remote Connections
Ensures /etc/issue.net (the remote pre-login banner) is owned by root (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/issue.net file holds the pre-login banner shown to remote users (notably by sshd via the Banner directive). If a non-root account owns it, that user can alter or remove the legal/usage notice, weakening the enforceability of acceptable-use policy and potentially injecting misleading text. Setting root (UID 0) as the owner ensures only privileged users can change the banner, keeping the notification consistent with applicable laws, policies and standards.
What Pavois checks
Pavois inspects the live filesystem with the InSpec file('/etc/issue.net') resource and asserts uid == 0, guarded by only_if so the test is skipped when the file is absent. Reading the actual inode owner (rather than trusting a config-management manifest or a copied template) reflects the effective state on disk, including any post-deployment chown an operator or compromised process may have performed.
only_if { file('/etc/issue.net').exist? }
describe file('/etc/issue.net') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u %n' /etc/issue.net. Expected output: root 0 /etc/issue.net. The numeric 0 confirms the rule even if the name service maps UID 0 to an unusual label.
Inspect & investigate
Ownership changes are not logged by default. With the audit framework, add a watch (auditctl -w /etc/issue.net -p wa -k banner) then inspect /var/log/audit/audit.log (filter on grep 'key="banner"'). The banner itself is emitted by SSH at connect time, visible in journalctl -u ssh / /var/log/auth.log.
Remediation
No automated remediation is shipped for this rule. Apply it manually with chown root /etc/issue.net (run as root or via sudo); the file should remain group root and mode 0644.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/issue.net |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A wrong owner lets a non-privileged user rewrite the legal notice users see before authenticating. Risk of applying: essentially none, /etc/issue.net is a static text file with no service dependency, so chown root does not interrupt logins or SSH. As a precaution, confirm the file is still readable (0644) afterward so the banner keeps displaying.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.2.8, 1.6.6, 1.7.6 | direct | per OS, see the benchmark table | high |
| PCI DSS | 1.2.8 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.