# Ensure permissions on /etc/ssh/sshd_config are configured

The /etc/ssh/sshd_config file is a critical configuration file that controls the behavior of the SSH daemon. Its security is paramount to prevent unauthorized system access and information disclosure. If an unauthorized user gains write access, they could alter security settings to weaken the system, such as permitting root login with a password, enabling weak ciphers, or disabling logging. Read access could expose sensitive configuration details to an attacker planning further exploits. The audit script verifies the file's permissions and ownership against security best practices. The remediation script uses 'chmod' and 'chown' to enforce the correct secure state. The Basic state ('640 root root') allows the root group to read the file, which is acceptable but not ideal. The Moderate and Strict states ('600 root root') adhere to the principle of least privilege and are the universally recommended configuration (e.g., by CIS Benchmarks), ensuring only the root user can read or write the file, providing the strongest protection against unauthorized viewing or modification.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['640 root root']` |
| **Moderate** | `['600 root root']` |
| **Strict** | `['600 root root']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that uses the 'stat' command to retrieve the octal permissions, owner, and group for the '/etc/ssh/sshd_config' file. The script must output a single line in the format 'permissions owner group' (e.g., '600 root root') with no extra text or labels.

## Remediation Script Working

shell script that sets the security configuration for the '/etc/ssh/sshd_config' file. The script must accept two positional arguments: the first for the octal permission mode (e.g., '600') and the second for the owner and group in 'user:group' format (e.g., 'root:root'). The script must return 'true' upon successful application of both ownership and permissions, and 'false' otherwise.

