Verify Owner on SSH Server Configuration Files
Ensures the /etc/ssh/sshd_config.d directory is owned by root (uid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/ssh/sshd_config.d directory holds drop-in files that override the SSH daemon's configuration. If its owner is not root (uid 0), a non-privileged user could drop in a file that re-enables PermitRootLogin, weakens authentication, or opens port forwarding, silently undermining the SSH hardening on the remote-access entry point of the host.
What Pavois checks
Pavois reads the effective owner uid of /etc/ssh/sshd_config.d from the filesystem (stat). This is precisely the drop-in directory that sshd includes, exactly the kind of path a file-only scanner inspecting sshd_config alone would overlook. Pavois audits the directory whose contents are actually merged into the running sshd -T configuration.
only_if { file('/etc/ssh/sshd_config.d').exist? }
describe file('/etc/ssh/sshd_config.d') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U' /etc/ssh/sshd_config.d. The expected output is root. Alternatively, ls -ld /etc/ssh/sshd_config.d should show root in the owner column.
Inspect & investigate
Ownership changes are not logged by default; inspect with ls -ld /etc/ssh/sshd_config.d. The effective merged config is shown by sshd -T. SSH service activity is in journalctl -u sshd and /var/log/secure (RHEL/Fedora). If auditd watches the directory, ownership changes appear in /var/log/audit/audit.log.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually: chown root /etc/ssh/sshd_config.d. Verify afterwards with stat -c '%U' /etc/ssh/sshd_config.d.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/ssh/sshd_config.d |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Setting the owner to root is the expected state and has no impact on the SSH service: sshd reads its config as root. There is no lockout risk, and existing sessions are unaffected. The change touches only directory metadata; no sshd restart is required.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.1.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.