All Interactive Users Home Directories Must Exist
Ensures every interactive account (UID ≥ 1000, excluding nobody) has the home directory declared in /etc/passwd actually present on disk.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
If an interactive user has a home directory defined that does not exist, on login the user may land in the / directory as their working directory. This can cause a denial of service (their shell init and config files are unreadable) and may expose system files they should not normally see, while user dotfiles get created in unexpected places.
What Pavois checks
Pavois resolves the live account database with awk over /etc/passwd, selecting real interactive users (UID ≥ 1000, not 65534, home ≠ /), then tests each declared home with [ -d "$h" ]. It reports the first missing directory. This reflects the effective state (passwd entries plus on-disk reality) rather than assuming /home layout from a config template.
describe command('awk -F: \'($3>=1000 && $3!=65534 && $6!="/"){print $3":"$4":"$6}\' /etc/passwd | while IFS=: read u g h; do [ -d "$h" ] || echo "$h"; done | head -1') do
its('stdout.strip') { should eq '' }
endHow to verify it is applied
Run awk -F: '($3>=1000 && $3!=65534 && $6!="/"){print $1, $6}' /etc/passwd then confirm each listed path exists (ls -ld <home>). Expected: every interactive user's home directory resolves to an existing directory.
Inspect & investigate
List offending users with awk -F: '($3>=1000 && $3!=65534){print $1, $6}' /etc/passwd and check getent passwd <user>. Login-time failures surface in /var/log/auth.log (Debian/Ubuntu) or via journalctl -u systemd-logind / PAM messages noting the missing home.
Remediation
No automated remediation is shipped (remediation is empty): apply manually. For each reported user, create the directory and fix ownership/permissions, e.g. mkdir -p /home/<user> && chown <user>:<group> /home/<user> && chmod 0750 /home/<user>, then populate it from /etc/skel if needed. Decide deliberately for service-like accounts whether they should be interactive at all.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | # Find interactive users whose home directory is missing, then create it deliberately: awk -F: '($3>=1000 && $7!~/(nologin|false)/){print $1" "$6}' /etc/passwd # mkdir -p <home>; chown <user>:<group> <home>; chmod 750 <home> |
|---|---|
| reason | creating/relocating a user's home is per-user and may need data migration |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Misconfiguration causes login failures or unexpected /-rooted sessions and can leak system file visibility. Precautions before applying: verify each flagged account is a genuine human/interactive user before creating a home, a daemon account with a missing home may be intentional; consider changing its shell to nologin instead. When creating directories, set ownership and 0750 immediately so you do not introduce a world-readable home.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 7.2.9, 7.2.8 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.