Verify ownership of System Login Banner
Ensures the login banner file /etc/issue is owned by the root user (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/issue is the pre-login banner shown on local (TTY) consoles. A standardized authorized-use notice must be displayed before granting access, and its wording must stay consistent with applicable laws and policies. Proper root ownership ensures only the administrator can edit the banner, preventing a local user from tampering with the legal notice or inserting misleading text.
What Pavois checks
Pavois stats the live inode of /etc/issue and asserts its owner is UID 0. Reading the actual filesystem metadata reflects the effective ownership of the banner that getty/agetty will display, not an installer default.
only_if { file('/etc/issue').exist? }
describe file('/etc/issue') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u' /etc/issue. The expected output is root 0.
Inspect & investigate
There is no runtime log for displaying the banner. To detect tampering, set an audit watch: auditctl -w /etc/issue -p wa -k issue, then review /var/log/audit/audit.log (grep for key="issue"). The banner itself can be checked at any console login or with cat /etc/issue.
Remediation
No automated harden plan is defined for this rule yet, so it must be fixed manually: run chown root /etc/issue to restore root ownership.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/issue |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner of /etc/issue can alter the legal login notice, weakening the authorized-use warning that may be required for prosecution of intruders. Fixing it is essentially risk-free: chown root does not change the banner text, so the displayed message is unchanged. The change applies immediately; no reboot is needed.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.6.5, 1.7.5 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.