Ensure permissions on SSH public host key files are configured

中级别 1自动化cos

说明

An SSH public key is one of two files used in SSH public key authentication. In this authentication method, a public key is a key that can be used for verifying digital signatures generated using a corresponding private key. Only a public key that corresponds to a private key will be able to authenticate successfully. If a public host key file is modified by an unauthorized user, the SSH service may be compromised.

检查方式

审计方法: Shell 命令

shell

alt0() { o=$(bash -c 'find /etc/ssh -xdev -type f -name '"'"'ssh_host_*_key.pub'"'"' -exec stat {} \;' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'File: ‘/etc/ssh/ssh_host_rsa_key.pub’' || { echo step1: missing 'File: ‘/etc/ssh/ssh_host_rsa_key.pub’'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Size: 382 Blocks: 8 IO Block: 4096 regular file' || { echo step1: missing 'Size: 382 Blocks: 8 IO Block: 4096 regular file'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Device: ca01h/51713d Inode: 8631758 Links: 1' || { echo step1: missing 'Device: ca01h/51713d Inode: 8631758 Links: 1'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: 2018-10-22 18:24:56.861750616 +0000' || { echo step1: missing 'Access: 2018-10-22 18:24:56.861750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Modify: 2018-10-22 18:24:56.861750616 +0000' || { echo step1: missing 'Modify: 2018-10-22 18:24:56.861750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Change: 2018-10-22 18:24:56.881750616 +0000' || { echo step1: missing 'Change: 2018-10-22 18:24:56.881750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Birth: -' || { echo step1: missing 'Birth: -'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'File: ‘/etc/ssh/ssh_host_ecdsa_key.pub’' || { echo step1: missing 'File: ‘/etc/ssh/ssh_host_ecdsa_key.pub’'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Size: 162 Blocks: 8 IO Block: 4096 regular file' || { echo step1: missing 'Size: 162 Blocks: 8 IO Block: 4096 regular file'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Device: ca01h/51713d Inode: 8631761 Links: 1' || { echo step1: missing 'Device: ca01h/51713d Inode: 8631761 Links: 1'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: 2018-10-22 18:24:56.897750616 +0000' || { echo step1: missing 'Access: 2018-10-22 18:24:56.897750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Modify: 2018-10-22 18:24:56.897750616 +0000' || { echo step1: missing 'Modify: 2018-10-22 18:24:56.897750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Change: 2018-10-22 18:24:56.917750616 +0000' || { echo step1: missing 'Change: 2018-10-22 18:24:56.917750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Birth: -' || { echo step1: missing 'Birth: -'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'File: ‘/etc/ssh/ssh_host_ed25519_key.pub’' || { echo step1: missing 'File: ‘/etc/ssh/ssh_host_ed25519_key.pub’'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Size: 82 Blocks: 8 IO Block: 4096 regular file' || { echo step1: missing 'Size: 82 Blocks: 8 IO Block: 4096 regular file'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Device: ca01h/51713d Inode: 8631763 Links: 1' || { echo step1: missing 'Device: ca01h/51713d Inode: 8631763 Links: 1'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: 2018-10-22 18:24:56.945750616 +0000' || { echo step1: missing 'Access: 2018-10-22 18:24:56.945750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Modify: 2018-10-22 18:24:56.945750616 +0000' || { echo step1: missing 'Modify: 2018-10-22 18:24:56.945750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Change: 2018-10-22 18:24:56.961750616 +0000' || { echo step1: missing 'Change: 2018-10-22 18:24:56.961750616 +0000'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Birth: -' || { echo step1: missing 'Birth: -'; return 1; }; }; if alt0; then echo compliant; fi

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Run the following commands to set permissions and ownership on the SSH host public key files # find /etc/ssh -xdev -type f -name 'ssh_host_*_key.pub' -exec chmod 0644 {} \; #find /etc/ssh -xdev -type f -name 'ssh_host_*_key.pub' -exec chown root:root {} \;

属性

操作系统: 任意
标签: access-controlcontainer-optimized-oscoscryptossh
参考: CIS Google Container-Optimized OS Benchmark v1.2.0 - 5.1.3 Ensure permissions on SSH public host key files are configured

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target cos