SV-227900r603266: The SSH public host key files must have mode 0644 or less permissive. | Solaris 10 X86 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The SSH public host key files must have mode 0644 or less permissive.

Description

Discussion Text

If a public host key file is modified by an unauthorized user, the SSH service may be compromised.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366V-22471SV-26764

References

DPMS Target Solaris 10 X86 DISA DPMS Target Solaris 10 X86 4061

Checks

DISA STIG (Manual Reference)

Check the permissions for SSH public host key files.
# ls -lL /etc/ssh/*key.pub
If any file has a mode more permissive than 0644, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.solaris11:def:329
for file in /etc/ssh/*.key.pub; do if [ ! -f "$file" ]; then continue; fi; mode=$(stat -c "%a" "$file"); if [ $(($mode & 0002)) -eq 0 ] && [ $(($mode & 0022)) -eq 0 ] && [ $(($mode & 0022)) -eq 0 ] && [ $(($mode & 0111)) -eq 0 ] && [ $(($mode & 0222)) -eq 0 ] && [ $(($mode & 0444)) -eq 0444 ]; then echo "PASS"; exit 0; fi; done; echo "FAIL"; exit 1;

Remediation

Change the permissions for the SSH public host key files.
# chmod 0644 /etc/ssh/*key.pub