Title

The SSH public host key files must have mode 0644 or less permissive. (Cat II impact)

Discussion

If a public host key file is modified by an unauthorized user, the SSH service may be compromised.

Check Content

Check the permissions for SSH public host key files. # ls -lL /etc/ssh/*key.pub If any file has a mode more permissive than 0644, this is a finding.

Fix Text

Change the permissions for the SSH public host key files. # chmod 0644 /etc/ssh/*key.pub

Additional Identifiers

Rule ID: SV-227900r603266_rule

Vulnerability ID: V-227900

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.