Ensure permissions on SSH public host key files are configured

MoyenneNiveau 1Automatiséelinux

Description

An SSH public key is one of two files used in SSH public key authentication. In this authentication method, a public key is a key that can be used for verifying digital signatures generated using a corresponding private key. Only a public key that corresponds to a private key will be able to authenticate successfully.

Méthode de vérification

Méthode d'audit: Commande shell

shell

alt0() { o=$(bash -c 'find /etc/ssh -xdev -type f -name '"'"'ssh_host_*_key.pub'"'"' -exec stat {} \;' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'File: ‘/etc/ssh/ssh_host_rsa_key.pub’' || { echo step1: missing 'File: ‘/etc/ssh/ssh_host_rsa_key.pub’'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Size: 382 Blocks: 8 IO Block: 4096 regular file' || { echo step1: missing 'Size: 382 Blocks: 8 IO Block: 4096 regular file'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Device: ca01h/51713d Inode: 8631758 Links: 1' || { echo step1: missing 'Device: ca01h/51713d Inode: 8631758 Links: 1'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: 2018-10-22 18:24:56.861750616 +0000' || { echo step1: missing 'Access: 2018-10-22 18:24:56.861750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Modify: 2018-10-22 18:24:56.861750616 +0000' || { echo step1: missing 'Modify: 2018-10-22 18:24:56.861750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Change: 2018-10-22 18:24:56.881750616 +0000' || { echo step1: missing 'Change: 2018-10-22 18:24:56.881750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Birth: -' || { echo step1: missing 'Birth: -'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'File: ‘/etc/ssh/ssh_host_ecdsa_key.pub’' || { echo step1: missing 'File: ‘/etc/ssh/ssh_host_ecdsa_key.pub’'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Size: 162 Blocks: 8 IO Block: 4096 regular file' || { echo step1: missing 'Size: 162 Blocks: 8 IO Block: 4096 regular file'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Device: ca01h/51713d Inode: 8631761 Links: 1' || { echo step1: missing 'Device: ca01h/51713d Inode: 8631761 Links: 1'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: 2018-10-22 18:24:56.897750616 +0000' || { echo step1: missing 'Access: 2018-10-22 18:24:56.897750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Modify: 2018-10-22 18:24:56.897750616 +0000' || { echo step1: missing 'Modify: 2018-10-22 18:24:56.897750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Change: 2018-10-22 18:24:56.917750616 +0000' || { echo step1: missing 'Change: 2018-10-22 18:24:56.917750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Birth: -' || { echo step1: missing 'Birth: -'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'File: ‘/etc/ssh/ssh_host_ed25519_key.pub’' || { echo step1: missing 'File: ‘/etc/ssh/ssh_host_ed25519_key.pub’'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Size: 82 Blocks: 8 IO Block: 4096 regular file' || { echo step1: missing 'Size: 82 Blocks: 8 IO Block: 4096 regular file'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Device: ca01h/51713d Inode: 8631763 Links: 1' || { echo step1: missing 'Device: ca01h/51713d Inode: 8631763 Links: 1'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: 2018-10-22 18:24:56.945750616 +0000' || { echo step1: missing 'Access: 2018-10-22 18:24:56.945750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Modify: 2018-10-22 18:24:56.945750616 +0000' || { echo step1: missing 'Modify: 2018-10-22 18:24:56.945750616 +0000'; return 1; }; }; if alt0; then echo compliant; fi

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Run the following commands to set permissions and ownership on the SSH host public key files # find /etc/ssh -xdev -type f -name 'ssh_host_*_key.pub' -exec chmod 0644 {} \; #find /etc/ssh -xdev -type f -name 'ssh_host_*_key.pub' -exec chown root:root {} \;

Propriétés

Systèmes d'exploitation: alinux-2
Étiquettes: cis-convertedlinux
Référence: CIS Aliyun Linux 2 Benchmark v1.0.0 ARCHIVE - 5.2.4

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target linux