Verify User Who Owns /etc/security/opasswd File
Ensures the password-history file /etc/security/opasswd is owned by root (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/security/opasswd file is maintained by pam_pwhistory/pam_unix and stores hashes of previous passwords to enforce the password-reuse (history) policy. If a non-root account owns it, that user could read those hashes (feeding offline cracking) or tamper with the history to bypass reuse rules. Setting root (UID 0) as the owner keeps this sensitive file under exclusive privileged control.
What Pavois checks
Pavois inspects the live filesystem with the InSpec file('/etc/security/opasswd') resource and asserts uid == 0, guarded by only_if so it is skipped when the history file has not yet been created. Reading the real inode owner reflects the effective on-disk state, catching a chown an attacker might use to exfiltrate old password hashes.
only_if { file('/etc/security/opasswd').exist? }
describe file('/etc/security/opasswd') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u %n' /etc/security/opasswd. Expected output: root 0 /etc/security/opasswd. The numeric 0 confirms root ownership.
Inspect & investigate
Watch the file with auditctl -w /etc/security/opasswd -p wa -k password-history and inspect /var/log/audit/audit.log (grep 'key="password-history"'). Password-change events that update it are logged by PAM in /var/log/auth.log / journalctl (passwd, pam_unix).
Remediation
No automated remediation is shipped for this rule. Apply it manually with chown root /etc/security/opasswd (run as root or via sudo); the file should be group root and mode 0600 to keep the hashes unreadable.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/security/opasswd |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner can read or forge stored password hashes, undermining the reuse policy and exposing credential material. Risk of applying: none, chown root does not affect PAM's ability to read/update the file. Precaution: ensure the mode stays restrictive (0600); never make this file group- or world-readable.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 7.1.10 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.