SV-285322r1268251: Windows Server 2025 OpenSSH public host key files must conform to minimum requirements. | Microsoft Windows Server 2025 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

Windows Server 2025 OpenSSH public host key files must conform to minimum requirements.

Description

Discussion Text

If a public host key file is modified by an unauthorized user, the SSH service may be compromised.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366

References

DPMS Target Microsoft Windows Server 2025 DISA DPMS Target Microsoft Windows Server 2025 5719

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISyntax-verified

A standalone PowerShell script to assess this control automatically. Review before running it in your environment.

Syntax-checked as valid PowerShell. Not executed here — running it for real needs the actual ms_windows_server_2025 target this check assesses.

# OVAL Definition: oval:mil.disa.stig.windows2025:def:285322
$sshPath = "C:\ProgramData\ssh\*.pub"
$adminGroup = [System.Security.Principal.NTAccount]"BUILTIN\Administrators"
$systemAccount = [System.Security.Principal.NTAccount]"NT AUTHORITY\SYSTEM"
$adminAccess = [System.Security.AccessControl.FileSystemRights]::FullControl -bor [System.Security.AccessControl.FileSystemRights]::ReadAttributes -bor [System.Security.AccessControl.FileSystemRights]::ReadData -bor [System.Security.AccessControl.FileSystemRights]::ReadExtendedAttributes -bor [System.Security.AccessControl.FileSystemRights]::ReadPermissions -bor [System.Security.AccessControl.FileSystemRights]::ReadProperties -bor [System.Security.AccessControl.FileSystemRights]::Synchronize -bor [System.Security.AccessControl.FileSystemRights]::WriteAttributes -bor [System.Security.AccessControl.FileSystemRights]::WritePermissions -bor [System.Security.AccessControl.FileSystemRights]::WriteProperties
$systemAccess = [System.Security.AccessControl.FileSystemRights]::FullControl -bor [System.Security.AccessControl.FileSystemRights]::ReadAttributes -bor [System.Security.AccessControl.FileSystemRights]::ReadData -bor [System.Security.AccessControl.FileSystemRights]::ReadExtendedAttributes -bor [System.Security.AccessControl.FileSystemRights]::ReadPermissions -bor [System.Security.AccessControl.FileSystemRights]::ReadProperties -bor [System.Security.AccessControl.FileSystemRights]::Synchronize -bor [System.Security.AccessControl.FileSystemRights]::WriteAttributes -bor [System.Security.AccessControl.FileSystemRights]::WritePermissions -bor [System.Security.AccessControl.FileSystemRights]::WriteProperties
if (Get-ChildItem -Path $sshPath -File -ErrorAction SilentlyContinue) {
    foreach ($file in Get-ChildItem -Path $sshPath -File) {
        $acl = Get-Acl -Path $file.FullName
        if (-not $acl.AccessToString($adminGroup.Value) -match "FullControl") { Write-Output "FAIL"; exit 1 }
        if (-not $acl.AccessToString($systemAccount.Value) -match "FullControl") { Write-Output "FAIL"; exit 1 }
    }
}
Write-Output "PASS"; exit 0

Remediation

Maintain the permissions of the public host key files as follows:

BUILTIN\Administrators:(F)
NT AUTHORITY\SYSTEM:(F)