Verify Permissions on /etc/sysconfig/sshd File
Ensures the RHEL /etc/sysconfig/sshd environment file is not writable or executable by group/other and not readable by other, protecting the SSH daemon's startup options.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
On RHEL-family systems the /etc/sysconfig/sshd file holds environment options for the SSH daemon (for example crypto-policy overrides) that are sourced when sshd starts. If a non-privileged user can write to it, they could inject options that weaken the daemon's security or alter its behaviour; if it is world-readable, sensitive tuning is disclosed. The file should be mode 0640 or more restrictive, owned by root, with no write/execute for group or other and no read for other.
What Pavois checks
Pavois reads the effective inode metadata of /etc/sysconfig/sshd and asserts no setuid/setgid/sticky bits, no write/execute for group, and no write/execute/read for other. Guarded by only_if { file('/etc/sysconfig/sshd').exist? }. Checking the live mode (rather than assuming the package default) catches any post-install drift that would actually change how sshd is launched.
only_if { file('/etc/sysconfig/sshd').exist? }
describe file('/etc/sysconfig/sshd') do
it { should_not be_executable.by('owner') }
it { should_not be_setuid }
it { should_not be_executable.by('group') }
it { should_not be_writable.by('group') }
it { should_not be_setgid }
it { should_not be_executable.by('other') }
it { should_not be_writable.by('other') }
it { should_not be_readable.by('other') }
it { should_not be_sticky }
endHow to verify it is applied
Run stat -c '%a %U %G' /etc/sysconfig/sshd. The expected output is 640 root root or stricter (e.g. 600): no write bit for group/other, no read bit for other.
Inspect & investigate
stat /etc/sysconfig/sshd shows the current mode. Changes to the file appear in /var/log/audit/audit.log if a watch is set (grep name="/etc/sysconfig/sshd"). The effect on the daemon is visible after a restart in journalctl -u sshd.
Remediation
No automated harden plan is defined for this rule yet, so apply it manually: chown root:root /etc/sysconfig/sshd then chmod 0640 /etc/sysconfig/sshd.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| mode | 0640 |
|---|---|
| path | /etc/sysconfig/sshd |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If the file is writable by a non-root user, that user can manipulate the SSH daemon's startup environment (e.g. relaxing crypto policy), undermining remote-access security. Precautions: tightening permissions on this file does not change SSH connectivity, so it is low-risk; just keep ownership as root and avoid 0600 only if a non-root monitoring tool legitimately needs to read it (rare).
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.1.3 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.