Verify User Who Owns /etc/security/opasswd.old File
Ensures the password-history backup /etc/security/opasswd.old is owned by root (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/security/opasswd.old file is the backup PAM writes when rotating /etc/security/opasswd; it likewise contains hashes of previous passwords. Being a backup makes it just as sensitive: if a non-root account owns it, those hashes can be read for offline cracking or the history can be tampered with. Setting root (UID 0) as the owner keeps the backup under exclusive privileged control.
What Pavois checks
Pavois inspects the live filesystem with the InSpec file('/etc/security/opasswd.old') resource and asserts uid == 0, guarded by only_if so it is skipped when no backup exists yet. Reading the real inode owner reflects the effective on-disk state and catches a chown that would expose the backed-up hashes.
only_if { file('/etc/security/opasswd.old').exist? }
describe file('/etc/security/opasswd.old') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u %n' /etc/security/opasswd.old. Expected output: root 0 /etc/security/opasswd.old. The numeric 0 confirms root ownership.
Inspect & investigate
Watch the file with auditctl -w /etc/security/opasswd.old -p wa -k password-history and inspect /var/log/audit/audit.log (grep 'key="password-history"'). It is rewritten during password changes, which PAM also logs in /var/log/auth.log / journalctl.
Remediation
No automated remediation is shipped for this rule. Apply it manually with chown root /etc/security/opasswd.old (run as root or via sudo); the file should be group root and mode 0600 to keep the hashes unreadable.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/security/opasswd.old |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner can read or forge the backed-up password hashes, exposing credential material. Risk of applying: none, chown root does not affect PAM's history handling. Precaution: keep the mode restrictive (0600); never make this backup group- or world-readable.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 7.1.10 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.