Ensure permissions on SSH public host key files are configured

СредњаНиво 1Аутоматскаcos

Опис

An SSH public key is one of two files used in SSH public key authentication. In this authentication method, a public key is a key that can be used for verifying digital signatures generated using a corresponding private key. Only a public key that corresponds to a private key will be able to authenticate successfully. If a public host key file is modified by an unauthorized user, the SSH service may be compromised.

Како се проверава

Метод провере: Команда љуске

shell

alt0() { o=$(bash -c 'find /etc/ssh -xdev -type f -name '"'"'ssh_host_*_key.pub'"'"' -exec stat {} \;' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'File: ‘/etc/ssh/ssh_host_rsa_key.pub’' || { echo step1: missing 'File: ‘/etc/ssh/ssh_host_rsa_key.pub’'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Size: 382 Blocks: 8 IO Block: 4096 regular file' || { echo step1: missing 'Size: 382 Blocks: 8 IO Block: 4096 regular file'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Device: ca01h/51713d Inode: 8631758 Links: 1' || { echo step1: missing 'Device: ca01h/51713d Inode: 8631758 Links: 1'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: 2018-10-22 18:24:56.861750616 +0000' || { echo step1: missing 'Access: 2018-10-22 18:24:56.861750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Modify: 2018-10-22 18:24:56.861750616 +0000' || { echo step1: missing 'Modify: 2018-10-22 18:24:56.861750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Change: 2018-10-22 18:24:56.881750616 +0000' || { echo step1: missing 'Change: 2018-10-22 18:24:56.881750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Birth: -' || { echo step1: missing 'Birth: -'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'File: ‘/etc/ssh/ssh_host_ecdsa_key.pub’' || { echo step1: missing 'File: ‘/etc/ssh/ssh_host_ecdsa_key.pub’'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Size: 162 Blocks: 8 IO Block: 4096 regular file' || { echo step1: missing 'Size: 162 Blocks: 8 IO Block: 4096 regular file'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Device: ca01h/51713d Inode: 8631761 Links: 1' || { echo step1: missing 'Device: ca01h/51713d Inode: 8631761 Links: 1'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: 2018-10-22 18:24:56.897750616 +0000' || { echo step1: missing 'Access: 2018-10-22 18:24:56.897750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Modify: 2018-10-22 18:24:56.897750616 +0000' || { echo step1: missing 'Modify: 2018-10-22 18:24:56.897750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Change: 2018-10-22 18:24:56.917750616 +0000' || { echo step1: missing 'Change: 2018-10-22 18:24:56.917750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Birth: -' || { echo step1: missing 'Birth: -'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'File: ‘/etc/ssh/ssh_host_ed25519_key.pub’' || { echo step1: missing 'File: ‘/etc/ssh/ssh_host_ed25519_key.pub’'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Size: 82 Blocks: 8 IO Block: 4096 regular file' || { echo step1: missing 'Size: 82 Blocks: 8 IO Block: 4096 regular file'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Device: ca01h/51713d Inode: 8631763 Links: 1' || { echo step1: missing 'Device: ca01h/51713d Inode: 8631763 Links: 1'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: 2018-10-22 18:24:56.945750616 +0000' || { echo step1: missing 'Access: 2018-10-22 18:24:56.945750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Modify: 2018-10-22 18:24:56.945750616 +0000' || { echo step1: missing 'Modify: 2018-10-22 18:24:56.945750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Change: 2018-10-22 18:24:56.961750616 +0000' || { echo step1: missing 'Change: 2018-10-22 18:24:56.961750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Birth: -' || { echo step1: missing 'Birth: -'; return 1; }; }; if alt0; then echo compliant; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Run the following commands to set permissions and ownership on the SSH host public key files # find /etc/ssh -xdev -type f -name 'ssh_host_*_key.pub' -exec chmod 0644 {} \; #find /etc/ssh -xdev -type f -name 'ssh_host_*_key.pub' -exec chown root:root {} \;

Својства

Оперативни системи: Било који
Ознаке: access-controlcontainer-optimized-oscoscryptossh
Референца: CIS Google Container-Optimized OS Benchmark v1.2.0 - 5.1.3 Ensure permissions on SSH public host key files are configured

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target cos