Verify Group Who Owns /etc/ipsec.d Directory
Ensures the /etc/ipsec.d directory, which holds Libreswan/IPsec configuration, is group-owned by root.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/ipsec.d directory hosts Libreswan (IPsec) configuration, including secrets and connection definitions used to set up VPN tunnels. Group-ownership by root ensures exclusive control: if a non-privileged group owned it, members could read or tamper with IPsec keys and policies, potentially redirecting or decrypting VPN traffic. Protecting this directory is critical to the integrity and confidentiality of the host's encrypted connections.
What Pavois checks
Pavois checks the effective group ownership of /etc/ipsec.d via the InSpec file resource, which reads the inode's real gid as resolved by the kernel (not a packaged default). The control is gated by only_if { file('/etc/ipsec.d').exist? }, so it is skipped on hosts without Libreswan installed rather than failing spuriously.
only_if { file('/etc/ipsec.d').exist? }
describe file('/etc/ipsec.d') do
its('group') { should eq 'root' }
endHow to verify it is applied
Run stat -c '%G' /etc/ipsec.d (or ls -ld /etc/ipsec.d). The output must be root.
Inspect & investigate
Ownership changes are not service-logged, but you can confirm current state with stat -c '%U:%G %a' /etc/ipsec.d and find /etc/ipsec.d -not -group root to spot any contained file with a non-root group. Use auditd watches on /etc/ipsec.d if you need an audit trail of modifications.
Remediation
pavois harden apply uses the file resource to set the group of /etc/ipsec.d to root (equivalent to chgrp root /etc/ipsec.d). It is idempotent and changes nothing if the group is already root.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /etc/ipsec.d |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Impact is minimal: changing the directory's group to root only restricts non-root group access, which is the intended hardening. Precaution: confirm no legitimate Libreswan helper or management tool relies on a non-root group to read this directory before applying (uncommon). If /etc/ipsec.d does not exist, the rule is skipped and harden makes no change.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.