Verify Owner on SSH Server config file
Ensures the SSH server configuration file /etc/ssh/sshd_config is owned by root (uid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/ssh/sshd_config controls every security-relevant aspect of the SSH server: authentication methods, root login, ciphers, port and access restrictions. A misconfiguration here leads directly to a remotely exploitable host. If a non-root user owns the file, they can edit it to enable PermitRootLogin yes, weaken authentication or open a backdoor, then trigger an sshd reload, escalating a local account to remote root access. Restricting ownership to root (uid 0) ensures only the superuser can change the SSH server's policy.
What Pavois checks
Pavois asserts that the live file /etc/ssh/sshd_config has owner uid 0, skipped via only_if if absent. It reads the effective owner from the filesystem (stat), so a manual chown of the main SSH policy file is detected even when no change-management record exists. (Note: Pavois audits the SSH server's behaviour via sshd -T in other rules; this ownership rule protects the integrity of the file that sshd -T ultimately reflects.)
only_if { file('/etc/ssh/sshd_config').exist? }
describe file('/etc/ssh/sshd_config') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u' /etc/ssh/sshd_config. Expected output: root 0. ls -l /etc/ssh/sshd_config should likewise show root as the owner.
Inspect & investigate
Ownership has no continuous log; query it with stat /etc/ssh/sshd_config. SSH service events and config-load errors appear in /var/log/auth.log (Debian/Ubuntu) or via journalctl -u ssh. sshd will refuse to start if it considers the config unsafe, logging the reason there.
Remediation
No automated harden plan is defined, so apply it manually: chown root:root /etc/ssh/sshd_config. Reinstalling openssh-server also restores correct ownership.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/ssh/sshd_config |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner of this file can rewrite SSH policy and gain remote root access, one of the highest-leverage local-to-remote escalations. Restoring root ownership is safe and does not drop current sessions. Precaution: after correcting ownership, run sshd -t to confirm the config still parses, do not loosen the file mode (keep 0600/0644 per baseline), and keep a second SSH session or console open before reloading sshd in case of a mistake.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
| CIS | 5.1.1, 5.1.2 | direct | per OS, see the benchmark table | high |
| NIST | AC-17(a), AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.