Oracle Linux 7 Security Technical Implementation Guide

The Oracle Linux 7 Security Technical Implementation Guide (V3 R5) has 243 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

243STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R5

CurrentPublished Mon Jan 05 2026

The Oracle Linux operating system must be configured so the SSH private host key files have mode 0640 or less permissive.

Oracle Linux 7 Security Technical Implementation Guide

Assessment Title

Rule Text

The Oracle Linux operating system must be configured so the SSH private host key files have mode 0640 or less permissive.

Description

Discussion Text

If an unauthorized user obtains the private SSH host key file, the host could be impersonated.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-221859

Rule

SV-221859r991589_rule

Severity

medium

Rule Version

OL07-00-040420

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the SSH private host key files have mode 0640 or less permissive.

The following command will find all SSH private key files on the system and list their modes:

     # find / -name '*ssh_host*key' | xargs ls -lL

     -rw-r----- 1 root ssh_keys 112 Apr 1 11:59 ssh_host_dsa_key
     -rw-r----- 1 root ssh_keys 202 Apr 1 11:59 ssh_host_key
     -rw-r----- 1 root ssh_keys 352 Apr 1 11:59 ssh_host_rsa_key

If any file has a mode more permissive than 0640, this is a finding.

Implementation Procedure

Fix Text

Configure the mode of SSH private host key files under "/etc/ssh" to "0640" with the following command:

     # chmod 0640 /path/to/file/ssh_host*key

STIG check 178 of 243 in the Oracle Linux 7 STIG checklist

← Previous · V-221858The Oracle Linux operating system must be configured so that the SSH public host key files have mode 0644 or less permissive.Next · V-221860 →The Oracle Linux operating system must be configured so that the SSH daemon does not permit Generic Security Service Application Program Interface (GSSAPI) authentication unless needed.