RHEL 9 SSH private host key files must have mode 0640 or less permissive.

STIG ID: RHEL-09-255120  |  SRG: SRG-OS-000480-GPOS-00227 |  Severity: medium |  CCI: CCI-000366 |  Vulnerability Id: V-258000

Vulnerability Discussion

If an unauthorized user obtains the private SSH host key file, the host could be impersonated.

Check

Verify the SSH private host key files have a mode of "0640" or less permissive with the following command:

$ ls -l /etc/ssh/*_key

640 /etc/ssh/ssh_host_dsa_key
640 /etc/ssh/ssh_host_ecdsa_key
640 /etc/ssh/ssh_host_ed25519_key
640 /etc/ssh/ssh_host_rsa_key

If any private host key file has a mode more permissive than "0640", this is a finding.

Fix

Configure the mode of SSH private host key files under "/etc/ssh" to "0640" with the following command:

$ sudo chmod 0640 /etc/ssh/ssh_host*key

Restart the SSH daemon for the changes to take effect:

$ sudo systemctl restart sshd.service
This website is not created by, run, approved, or endorsed by the U.S. Department of Defense. Use at your own risk. This website is created by open-source software.