Check Details

• Resource: Server
• Check: Verify SSH Private Host Key Permissions
• Risk: Improper permissions on SSH private keys may allow unauthorized access and server impersonation.

Remediation Steps

1. Open a terminal session on the server with root or sudo privileges.

2. Run the following command to identify SSH private host key files and verify their permissions and ownership.

   

   find /etc/ssh -xdev -type f -name 'ssh_host_*_key' -exec stat {} \;
   

3. Review the output and ensure:

   • Owner (Uid) is root
   • Group (Gid) is root
   • Permissions are set to 0600 (-rw-------)

4. If ownership is incorrect, run the following command to set correct ownership.

   

   find /etc/ssh -xdev -type f -name 'ssh_host_*_key' -exec chown root:root {} \;
   

5. If permissions are too permissive, run the following command to restrict access.

   

   find /etc/ssh -xdev -type f -name 'ssh_host_*_key' -exec chmod 0600 {} \;
   

6. Re-run the audit command to confirm that all SSH private key files now have secure permissions and ownership.
7. Implement regular system audits to ensure SSH key security is maintained.