cis-ubuntu1804-v220-4-2-2

name	cis-ubuntu1804-v220-4-2-2
description	Ensure access to SSH private host key files is configured
category	cis-networking
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","ssh","remote-access"]
cis_id	4.2.2
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 4.2.2

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

An SSH private host key is an SSH key pair used to authenticate the identity of the host to clients and should be accessible only by the owner (typically root) and the group (typically root or ssh key group).

Rationale

If an unauthorized user obtains the SSH private host key, they could use it to impersonate the host or perform a man-in-the-middle attack.

Audit Procedure

Command Line

Run the following script to verify SSH private host key files have the correct permissions:

#!/usr/bin/env bash
{
  l_output="" l_output2=""
  l_skgn="ssh_keys"
  l_skgid="$(awk -F: '($1 == "'"$l_skgn"'"){print $3}' /etc/group)"
  if [ -n "$l_skgid" ]; then
    l_aession="(root|$l_skgn)"
    l_agession="(0|$l_skgid)"
  else
    l_aession="root"
    l_agession="0"
  fi
  awk '{print}' <<< "$(find -L /etc/ssh -xdev -type f -exec stat -Lc '%n %#a %U %G %g' {} +)" | (
    while IFS= read -r l_file_mode; do
      l_file="$(awk '{print $1}' <<< "$l_file_mode")"
      if grep -Pq '\.pub$' <<< "$l_file"; then
        continue
      fi
       file  | grep -Pq ; 
        l_mode=
         [ $((  &  )) -gt 0 ]; 
          l_output2=
        
        l_owner=
         [  !=  ]; 
          l_output2=
        
        l_group=
        l_gid=
         ! grep -Pq  <<<  || ! grep -Pq  <<< ; 
          l_output2=
        
      
    
     [ -z  ]; 
       -e 
    
       -e 
    
  )
}