The Photon operating system must be configured to protect the Secure Shell (SSH) public host key from unauthorized modification.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-258895	SRG-OS-000480-GPOS-00227	PHTN-40-000233	SV-258895r991589_rule	2024-07-11	2

Description
If a public host key file is modified by an unauthorized user, the SSH service may be compromised.

ℹ️ Check
At the command line, run the following command: # stat -c "%n permissions are %a and owned by %U:%G" /etc/ssh/*key.pub Example result: /etc/ssh/ssh_host_dsa_key.pub permissions are 644 and owned by root:root /etc/ssh/ssh_host_ecdsa_key.pub permissions are 644 and owned by root:root /etc/ssh/ssh_host_ed25519_key.pub permissions are 644 and owned by root:root /etc/ssh/ssh_host_rsa_key.pub permissions are 644 and owned by root:root If any "key.pub" file listed is not owned by root or not group owned by root or does not have permissions of "0644", this is a finding.

ℹ️ Check

At the command line, run the following command: # stat -c "%n permissions are %a and owned by %U:%G" /etc/ssh/*key.pub Example result: /etc/ssh/ssh_host_dsa_key.pub permissions are 644 and owned by root:root /etc/ssh/ssh_host_ecdsa_key.pub permissions are 644 and owned by root:root /etc/ssh/ssh_host_ed25519_key.pub permissions are 644 and owned by root:root /etc/ssh/ssh_host_rsa_key.pub permissions are 644 and owned by root:root If any "key.pub" file listed is not owned by root or not group owned by root or does not have permissions of "0644", this is a finding.

✔️ Fix
At the command line, run the following commands for each returned file: # chmod 644 <file> # chown root:root <file> # systemctl restart sshd.service