TMA-COS-5.1.3
Ensure permissions on SSH public host key files are configured
OrtaDüzey 1Otomatikcos
Açıklama
An SSH public key is one of two files used in SSH public key authentication. In this authentication method, a public key is a key that can be used for verifying digital signatures generated using a corresponding private key. Only a public key that corresponds to a private key will be able to authenticate successfully. If a public host key file is modified by an unauthorized user, the SSH service may be compromised.
Nasıl denetlenir
Denetim yöntemi: Kabuk komutu
shell
alt0() { o=$(bash -c 'find /etc/ssh -xdev -type f -name '"'"'ssh_host_*_key.pub'"'"' -exec stat {} \;' 2>&1); printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'File: ‘/etc/ssh/ssh_host_rsa_key.pub’' || { echo step1: missing 'File: ‘/etc/ssh/ssh_host_rsa_key.pub’'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Size: 382 Blocks: 8 IO Block: 4096 regular file' || { echo step1: missing 'Size: 382 Blocks: 8 IO Block: 4096 regular file'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Device: ca01h/51713d Inode: 8631758 Links: 1' || { echo step1: missing 'Device: ca01h/51713d Inode: 8631758 Links: 1'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: 2018-10-22 18:24:56.861750616 +0000' || { echo step1: missing 'Access: 2018-10-22 18:24:56.861750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Modify: 2018-10-22 18:24:56.861750616 +0000' || { echo step1: missing 'Modify: 2018-10-22 18:24:56.861750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Change: 2018-10-22 18:24:56.881750616 +0000' || { echo step1: missing 'Change: 2018-10-22 18:24:56.881750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Birth: -' || { echo step1: missing 'Birth: -'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'File: ‘/etc/ssh/ssh_host_ecdsa_key.pub’' || { echo step1: missing 'File: ‘/etc/ssh/ssh_host_ecdsa_key.pub’'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Size: 162 Blocks: 8 IO Block: 4096 regular file' || { echo step1: missing 'Size: 162 Blocks: 8 IO Block: 4096 regular file'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Device: ca01h/51713d Inode: 8631761 Links: 1' || { echo step1: missing 'Device: ca01h/51713d Inode: 8631761 Links: 1'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: 2018-10-22 18:24:56.897750616 +0000' || { echo step1: missing 'Access: 2018-10-22 18:24:56.897750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Modify: 2018-10-22 18:24:56.897750616 +0000' || { echo step1: missing 'Modify: 2018-10-22 18:24:56.897750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Change: 2018-10-22 18:24:56.917750616 +0000' || { echo step1: missing 'Change: 2018-10-22 18:24:56.917750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Birth: -' || { echo step1: missing 'Birth: -'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'File: ‘/etc/ssh/ssh_host_ed25519_key.pub’' || { echo step1: missing 'File: ‘/etc/ssh/ssh_host_ed25519_key.pub’'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Size: 82 Blocks: 8 IO Block: 4096 regular file' || { echo step1: missing 'Size: 82 Blocks: 8 IO Block: 4096 regular file'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Device: ca01h/51713d Inode: 8631763 Links: 1' || { echo step1: missing 'Device: ca01h/51713d Inode: 8631763 Links: 1'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: 2018-10-22 18:24:56.945750616 +0000' || { echo step1: missing 'Access: 2018-10-22 18:24:56.945750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Modify: 2018-10-22 18:24:56.945750616 +0000' || { echo step1: missing 'Modify: 2018-10-22 18:24:56.945750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Change: 2018-10-22 18:24:56.961750616 +0000' || { echo step1: missing 'Change: 2018-10-22 18:24:56.961750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Birth: -' || { echo step1: missing 'Birth: -'; return 1; }; }; if alt0; then echo compliant; fi- Beklenen çıktı
compliant
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Run the following commands to set permissions and ownership on the SSH host public key files # find /etc/ssh -xdev -type f -name 'ssh_host_*_key.pub' -exec chmod 0644 {} \; #find /etc/ssh -xdev -type f -name 'ssh_host_*_key.pub' -exec chown root:root {} \;
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- access-controlcontainer-optimized-oscoscryptossh
- Referans
- CIS Google Container-Optimized OS Benchmark v1.2.0 - 5.1.3 Ensure permissions on SSH public host key files are configured
Bu ana makineyi denetle
Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.
shell
tmaegis scan --target cos