Verify Permissions on SSH Server Private *_key Key Files
An XCCDF Rule
Description
SSH server private keys - files that match the /etc/ssh/*_key glob, have to have restricted permissions.
If those files are owned by the root user and the root group, they have to have the 0640 permission or stricter.
If they are owned by the root user, but by a dedicated group ssh_keys, they can have the 0640 permission or stricter.
Rationale
If an unauthorized user obtains the private SSH host key file, the host could be impersonated.
- ID
- xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key
- Severity
- Medium
- References
- Updated