Detections
Analytics

5.1.3 Ensure access to SSH private host key files is configured

Information

An SSH private key is one of two files used in SSH public key authentication. In this authentication method, the possession of the private key is proof of identity. Only a private key that corresponds to a public key will be able to authenticate successfully. The private keys need to be stored and handled carefully, and no copies of the private key should be distributed.

If an unauthorized user obtains the private SSH host key file, the host could be impersonated.

Solution

Run the following script to set the owner and restrict permissions on each SSH private host key file from the running sshd configuration:

#!/usr/bin/env bash
{
 while IFS= read -r l_file; do
 ssh-keygen -lf "$l_file" &>/dev/null || continue
 chown root:root "$l_file"
 chmod u-x,go-rwx "$l_file"
 done < <(sshd -T 2>/dev/null | awk '$1=="hostkey"{print $2}')
}

 - OR - Where host-based authentication requires the ssh_keys group to read the host keys, set group ownership to ssh_keys with mode 0640 or more restrictive instead:

#!/usr/bin/env bash
{
 while IFS= read -r l_file; do
 ssh-keygen -lf "$l_file" &>/dev/null || continue
 chown root:ssh_keys "$l_file"
 chmod u-x,g-wx,o-rwx "$l_file"
 done < <(sshd -T 2>/dev/null | awk '$1=="hostkey"{print $2}')
}

Impact:

sshd enforces the ownership and permissions of host private keys, so an incorrect combination can cause a key to be ignored, and if no usable host key remains, sshd will not start. Acceptable access is owner root with either group root and mode 0600 or more restrictive, or (where host-based authentication via ssh-keysign is used) group ssh_keys and mode 0640 or more restrictive; over-restricting a host-based-authentication key to root:root 0600 will disable that authentication.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|CM-6b., 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: e5f069f801181c0a63e43673b9772960e8a6767508a0793766d44cf61574a791