Ensure access to SSH private host key files is configured

Trung bìnhCấp 1Tự độnglinux

Mô tả

An SSH private key is one of two files used in SSH public key authentication. In this authentication method, the possession of the private key is proof of identity. Only a private key that corresponds to a public key will be able to authenticate successfully. The private keys need to be stored and handled carefully, and no copies of the private key should be distributed.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash
{
   l_ssh_group=""
   grep -Psiq -- '"'"'^\h*ID_LIKE="?([^#\n\r]+)?\bfedora\b'"'"' /etc/os-release 2>/dev/null && \
      grep -Psq -- '"'"'^ssh_keys\b'"'"' /etc/group 2>/dev/null && l_ssh_group="ssh_keys"
   while IFS= read -r l_file; do
      ssh-keygen -lf "$l_file" &>/dev/null || continue
      while IFS=: read -r l_mode l_owner l_group; do
         [ "$l_group" = "$l_ssh_group" ] && l_mask="0137" || l_mask="0177"
         if [ $(( l_mode & l_mask )) -gt 0 ] || [ "$l_owner" != "root" ] || \
            { [ "$l_group" != "$l_ssh_group" ] && [ "$l_group" != "root" ];
}; then
            printf '"'"'%s\n'"'"' "\"$l_file\": mode $l_mode owner $l_owner group $l_group"
         fi
      done < <(stat -Lc '"'"'%#a:%U:%G'"'"' "$l_file")
   done < <(sshd -T 2>/dev/null | awk '"'"'$1=="hostkey"{print $2}'"'"')
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Run the following script to set the owner and restrict permissions on each SSH private host key file from the running sshd configuration: #!/usr/bin/env bash { while IFS= read -r l_file; do ssh-keygen -lf "$l_file" &>/dev/null || continue chown root:root "$l_file" chmod u-x,go-rwx "$l_file" done < <(sshd -T 2>/dev/null | awk '$1=="hostkey"{print $2}') } • OR - Where host-based authentication requires the ssh_keys group to read the host keys, set group ownership to ssh_keys with mode 0640 or more restrictive instead: #!/usr/bin/env bash { while IFS= read -r l_file; do ssh-keygen -lf "$l_file" &>/dev/null || continue chown root:ssh_keys "$l_file" chmod u-x,g-wx,o-rwx "$l_file" done < <(sshd -T…

Thuộc tính

Hệ điều hành: rocky-9
Thẻ: cis-convertedlinux
Tham chiếu: CIS Rocky Linux 9 Benchmark v3.0.0 - 5.1.3

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target linux