The Photon operating system must be configured to protect the Secure Shell (SSH) public host key from unauthorized modification.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-256577	SRG-OS-000480-GPOS-00227	PHTN-30-000108	SV-256577r991589_rule	2024-12-16	1

Description
If a public host key file is modified by an unauthorized user, the SSH service may be compromised.

ℹ️ Check
At the command line, run the following command: # stat -c "%n permissions are %a and owned by %U:%G" /etc/ssh/*key.pub Expected result: /etc/ssh/ssh_host_ecdsa_key.pub permissions are 644 and owned by root:root /etc/ssh/ssh_host_ed25519_key.pub permissions are 644 and owned by root:root /etc/ssh/ssh_host_rsa_key.pub permissions are 644 and owned by root:root If the output does not match the expected result, this is a finding.

ℹ️ Check

At the command line, run the following command: # stat -c "%n permissions are %a and owned by %U:%G" /etc/ssh/*key.pub Expected result: /etc/ssh/ssh_host_ecdsa_key.pub permissions are 644 and owned by root:root /etc/ssh/ssh_host_ed25519_key.pub permissions are 644 and owned by root:root /etc/ssh/ssh_host_rsa_key.pub permissions are 644 and owned by root:root If the output does not match the expected result, this is a finding.

✔️ Fix
At the command line, run the following commands for each returned file: # chmod 644 <file> # chown root:root <file>