Verify User Who Owns /etc/ipsec.d Directory
Ensures the /etc/ipsec.d directory is owned by root (uid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/ipsec.d directory holds the Libreswan IPsec configuration, including connection definitions and the private keys/certificates used to establish VPN tunnels. If its owner is not root (uid 0), a non-privileged user could alter tunnel parameters or read secret material, enabling traffic interception or unauthorized VPN access. Root ownership keeps exclusive control over the IPsec trust material.
What Pavois checks
Pavois reads the effective owner uid of /etc/ipsec.d from the filesystem (stat), reporting the real on-disk state rather than a value assumed from documentation. This is the directory Libreswan actually loads its connections and secrets from, so its ownership is what determines real exposure.
only_if { file('/etc/ipsec.d').exist? }
describe file('/etc/ipsec.d') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U' /etc/ipsec.d. The expected output is root. Alternatively, ls -ld /etc/ipsec.d should show root in the owner column.
Inspect & investigate
Ownership changes are not logged by default; inspect with ls -ld /etc/ipsec.d. IPsec/Libreswan service activity is in journalctl -u ipsec and the pluto logs. If auditd watches /etc/ipsec.d, ownership changes appear in /var/log/audit/audit.log.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually: chown root /etc/ipsec.d. Verify afterwards with stat -c '%U' /etc/ipsec.d.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/ipsec.d |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Setting the owner to root is the expected state and has no functional impact: the IPsec daemon runs as root. There is no lockout risk. Before applying, ensure no non-root management tool legitimately owns this path (uncommon); the change touches only directory metadata, not tunnel definitions.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.