cis-ubuntu2004-v300-5-1-3

name	cis-ubuntu2004-v300-5-1-3
description	Ensure access to SSH public host key files is configured
category	cis-networking
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","ssh"]
cis_id	5.1.3
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure access to SSH public host key files is configured (Automated)

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

An SSH public key is one of two files used in SSH public key authentication. In this authentication method, a public key is a key that can be used for verifying digital signatures generated using a corresponding private key. Only a public key that corresponds to a private key will be able to authenticate successfully.

Rationale

If a public host key file is modified by an unauthorized user, the SSH service may be compromised.

Audit Procedure

Command Line

Run the following command and verify Access does not grant write or execute permissions to group or other for all returned files: Run the following script to verify SSH public host key files are mode 0644 or more restrictive, owned by the root user, and owned by the root group:

#!/usr/bin/env bash

{
  a_output=(); a_output2=()
  l_pmask="0133"; l_maxperm="$( printf '%o' $(( 0777 & ~$l_pmask )) )"
  f_file_chk()
  {
    while IFS=: read -r l_file_mode l_file_owner l_file_group; do
      a_out2=()
      if [ $(( $l_file_mode & $l_pmask )) -gt 0 ]; then
        a_out2+=("      Mode: \"$l_file_mode\" should be mode: \"$l_maxperm\" or more restrictive")
      fi
      if [ "$l_file_owner" != "root" ]; then
        a_out2+=("      Owned by: \"$l_file_owner\" should be owned by: \"root\"")
      fi
      if [ "$l_file_group" != "root" ]; 
        a_out2+=()
      
       [  -gt  ]; 
        a_output2+=( )
      
        a_output+=( \
         )
      
     < <( -Lc  )
  }
   IFS=  -r -d $ l_file; 
     ssh-keygen -lf &>/dev/null ; 
      file  | grep -Piq --  && f_file_chk
    
   < <(find -L /etc/ssh -xdev - f -print0 2>/dev/null)
   [  -le 0 ]; 
    [  -le 0 ] && a_output+=()
          
  
          
    [  -gt 0 ] &&      
  
}