Skip to content

Check file-ownership

Overview

Verifies that critical system files have the expected owner and group. Ships with a built-in list of important files (GRUB, SSH, sudoers, PAM, cron, etc.) and supports custom entries. Alerts when the actual ownership does not match the expected values.

This plugin is part of the file plugin group. Selecting files with globs and what to do when the plugin cannot read a file are described once in PLUGINS-FILE.md.

Important Notes:

  • --filename entries are merged with the default file list. If the same path appears in both, the user-supplied entry wins. Use --no-default-files to skip the defaults entirely.
  • The following CIS-recommended files are excluded from the defaults because their ownership differs across RHEL, Debian, Ubuntu and SLES: /etc/gshadow, /etc/gshadow-, /etc/shadow, /etc/shadow-. To check these, add them via --filename with suitable values.

Default files checked:

  • /boot/grub/grub.cfg: root:root
  • /boot/grub/grub.conf: root:root
  • /boot/grub2/grub.cfg: root:root
  • /boot/grub2/grubenv: root:root
  • /boot/grub2/user.cfg: root:root
  • /etc/anacrontab: root:root
  • /etc/at.allow: root:root
  • /etc/cron.allow: root:root
  • /etc/cron.d: root:root
  • /etc/cron.daily: root:root
  • /etc/cron.hourly: root:root
  • /etc/cron.monthly: root:root
  • /etc/cron.weekly: root:root
  • /etc/crontab: root:root
  • /etc/default/grub: root:root
  • /etc/fstab: root:root
  • /etc/graylog/certs: graylog:graylog
  • /etc/group: root:root
  • /etc/group-: root:root
  • /etc/hosts: root:root
  • /etc/hosts.allow: root:root
  • /etc/hosts.deny: root:root
  • /etc/issue: root:root
  • /etc/issue.net: root:root
  • /etc/login.defs: root:root
  • /etc/logrotate.conf: root:root
  • /etc/logrotate.d: root:root
  • /etc/loolwsd/loolwsd.xml: lool:lool
  • /etc/motd: root:root
  • /etc/named.conf: root:named
  • /etc/pam.d: root:root
  • /etc/passwd: root:root
  • /etc/passwd-: root:root
  • /etc/profile: root:root
  • /etc/rsyslog.conf: root:root
  • /etc/security/access.conf: root:root
  • /etc/security/limits.conf: root:root
  • /etc/shells: root:root
  • /etc/ssh/ssh_config: root:root
  • /etc/ssh/sshd_config: root:root
  • /etc/sssd/sssd.conf: root:root
  • /etc/sudoers: root:root
  • /etc/sudoers.d: root:root
  • /etc/sysctl.conf: root:root
  • /etc/sysctl.d: root:root
  • /etc/systemd/coredump.conf: root:root
  • /etc/systemd/journald.conf: root:root
  • /etc/systemd/logind.conf: root:root
  • /etc/systemd/system.conf: root:root
  • /home/ovirt: vdsm:kvm
  • /tmp: root:root
  • /tmp/linuxfabrik-monitoring-plugins-sqlite.db: icinga:icinga
  • /var/hnet: hnet:hnet
  • /var/lib/unbound/root.key: unbound:unbound
  • /var/run/openldap: ldap:ldap

Data Collection:

  • Depending on the file and user (e.g. running as icinga), sudo may be needed
  • Uses os.stat() to read file ownership directly, without shelling out to external commands
  • Resolves numeric UIDs/GIDs to names. If a UID/GID has no corresponding name, the numeric value is displayed
  • Files that do not exist on the system are silently skipped

Fact Sheet

Fact Value
Check Plugin Download https://github.com/Linuxfabrik/monitoring-plugins/tree/main/check-plugins/file-ownership
Nagios/Icinga Check Name check_file_ownership
Check Interval Recommendation Every 5 minutes
Can be called without parameters Yes
Runs on Cross-platform
Compiled for Windows No

Help

usage: file-ownership [-h] [-V] [--always-ok] [--filename FILES]
                      [--no-default-files]

Verifies that critical system files have the expected owner and group. Ships
with a built-in list of important files (GRUB, SSH, sudoers, PAM, cron, etc.)
and supports custom entries. Alerts when the actual ownership does not match
the expected values.

options:
  -h, --help          show this help message and exit
  -V, --version       show program's version number and exit
  --always-ok         Always returns OK.
  --filename FILES    File to be checked. Format: `owner:group,path`. Can be
                      specified multiple times. User-supplied entries are
                      merged with the default file list. If the same path
                      appears in both, the user-supplied entry wins. Example:
                      `--filename root:root,/etc/passwd`.
  --no-default-files  Only check files specified via `--filename`, skip the
                      built-in default file list.

Documentation:
https://linuxfabrik.github.io/monitoring-plugins/check-plugins/file-ownership/

Usage Examples

Using default file list:

./file-ownership

Output:

Everything is ok.

Path                       ! Expected        ! Found
---------------------------+-----------------+----------------
/etc/anacrontab            ! root:root       ! root:root
/etc/cron.d                ! root:root       ! root:root
/etc/crontab               ! root:root       ! root:root
/etc/default/grub          ! root:root       ! root:root
/etc/fstab                 ! root:root       ! root:root
...

Adding files to the defaults (merged, user entry wins on duplicate paths):

./file-ownership --filename root:root,/etc/shadow --filename root:root,/etc/shadow-

Checking only specific files (no defaults):

./file-ownership --no-default-files --filename root:root,/etc/passwd --filename root:root,/etc/shadow

States

  • OK if all checked files have the expected owner and group.
  • WARN if any file's owner or group does not match the expected value.

Perfdata / Metrics

There is no perfdata.

Credits, License