Verify User Who Owns /etc/sysconfig/sshd File
Ensures the SSH daemon startup config /etc/sysconfig/sshd is owned by root (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
On RHEL-family systems, /etc/sysconfig/sshd holds the environment and startup options sourced by the sshd service unit (e.g. OPTIONS, CRYPTO_POLICY). If a non-root account owns it, that user could weaken the SSH daemon, for example overriding the system crypto policy or injecting unsafe flags, affecting every remote login. Setting root (UID 0) as the owner prevents unauthorized changes to the SSH startup configuration.
What Pavois checks
Pavois inspects the live filesystem with the InSpec file('/etc/sysconfig/sshd') resource and asserts uid == 0, guarded by only_if so it is skipped when the file is absent. This file feeds the sshd unit's environment; reading the real inode owner reflects the effective on-disk state and catches a chown that could let a user alter how SSH starts (note the daemon's runtime config is separately verified via sshd -T).
only_if { file('/etc/sysconfig/sshd').exist? }
describe file('/etc/sysconfig/sshd') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u %n' /etc/sysconfig/sshd. Expected output: root 0 /etc/sysconfig/sshd. The numeric 0 confirms root ownership.
Inspect & investigate
Watch the file with auditctl -w /etc/sysconfig/sshd -p wa -k sshd-conf and inspect /var/log/audit/audit.log (grep 'key="sshd-conf"'). SSH service starts and authentication events appear in journalctl -u sshd and /var/log/secure.
Remediation
No automated remediation is shipped for this rule. Apply it manually with chown root /etc/sysconfig/sshd (run as root or via sudo); the file should remain group root and mode 0640.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/sysconfig/sshd |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner could weaken or sabotage how sshd starts, affecting all remote access. Risk of applying: none, chown root only fixes ownership and does not restart sshd or change its behavior. As a precaution, after any later content edit run systemctl restart sshd from a second session so you can recover if the daemon fails to start.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.1.3 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.