TMA-COS-5.1.3

Ensure permissions on SSH public host key files are configured

MediaNivel 1Automatizadacos

Descripción

An SSH public key is one of two files used in SSH public key authentication. In this authentication method, a public key is a key that can be used for verifying digital signatures generated using a corresponding private key. Only a public key that corresponds to a private key will be able to authenticate successfully. If a public host key file is modified by an unauthorized user, the SSH service may be compromised.

Cómo se verifica

Método de auditoría: Comando de shell

shell

alt0() { o=$(bash -c 'find /etc/ssh -xdev -type f -name '"'"'ssh_host_*_key.pub'"'"' -exec stat {} \;' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'File: ‘/etc/ssh/ssh_host_rsa_key.pub’' || { echo step1: missing 'File: ‘/etc/ssh/ssh_host_rsa_key.pub’'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Size: 382 Blocks: 8 IO Block: 4096 regular file' || { echo step1: missing 'Size: 382 Blocks: 8 IO Block: 4096 regular file'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Device: ca01h/51713d Inode: 8631758 Links: 1' || { echo step1: missing 'Device: ca01h/51713d Inode: 8631758 Links: 1'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: 2018-10-22 18:24:56.861750616 +0000' || { echo step1: missing 'Access: 2018-10-22 18:24:56.861750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Modify: 2018-10-22 18:24:56.861750616 +0000' || { echo step1: missing 'Modify: 2018-10-22 18:24:56.861750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Change: 2018-10-22 18:24:56.881750616 +0000' || { echo step1: missing 'Change: 2018-10-22 18:24:56.881750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Birth: -' || { echo step1: missing 'Birth: -'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'File: ‘/etc/ssh/ssh_host_ecdsa_key.pub’' || { echo step1: missing 'File: ‘/etc/ssh/ssh_host_ecdsa_key.pub’'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Size: 162 Blocks: 8 IO Block: 4096 regular file' || { echo step1: missing 'Size: 162 Blocks: 8 IO Block: 4096 regular file'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Device: ca01h/51713d Inode: 8631761 Links: 1' || { echo step1: missing 'Device: ca01h/51713d Inode: 8631761 Links: 1'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: 2018-10-22 18:24:56.897750616 +0000' || { echo step1: missing 'Access: 2018-10-22 18:24:56.897750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Modify: 2018-10-22 18:24:56.897750616 +0000' || { echo step1: missing 'Modify: 2018-10-22 18:24:56.897750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Change: 2018-10-22 18:24:56.917750616 +0000' || { echo step1: missing 'Change: 2018-10-22 18:24:56.917750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Birth: -' || { echo step1: missing 'Birth: -'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'File: ‘/etc/ssh/ssh_host_ed25519_key.pub’' || { echo step1: missing 'File: ‘/etc/ssh/ssh_host_ed25519_key.pub’'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Size: 82 Blocks: 8 IO Block: 4096 regular file' || { echo step1: missing 'Size: 82 Blocks: 8 IO Block: 4096 regular file'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Device: ca01h/51713d Inode: 8631763 Links: 1' || { echo step1: missing 'Device: ca01h/51713d Inode: 8631763 Links: 1'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: 2018-10-22 18:24:56.945750616 +0000' || { echo step1: missing 'Access: 2018-10-22 18:24:56.945750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Modify: 2018-10-22 18:24:56.945750616 +0000' || { echo step1: missing 'Modify: 2018-10-22 18:24:56.945750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Change: 2018-10-22 18:24:56.961750616 +0000' || { echo step1: missing 'Change: 2018-10-22 18:24:56.961750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Birth: -' || { echo step1: missing 'Birth: -'; return 1; }; }; if alt0; then echo compliant; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Run the following commands to set permissions and ownership on the SSH host public key files # find /etc/ssh -xdev -type f -name 'ssh_host_*_key.pub' -exec chmod 0644 {} \; #find /etc/ssh -xdev -type f -name 'ssh_host_*_key.pub' -exec chown root:root {} \;

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: access-controlcontainer-optimized-oscoscryptossh
Referencia: CIS Google Container-Optimized OS Benchmark v1.2.0 - 5.1.3 Ensure permissions on SSH public host key files are configured

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target cos