# Ensure permissions on SSH public host key files are configured

Necessity: SSH public host keys are used by clients to verify the identity of the server and prevent man-in-the-middle (MITM) attacks. If the public key files have weak permissions, an attacker with local access could modify or replace them, allowing them to impersonate the server and intercept encrypted traffic. Ensuring these files are writable only by the root user is critical to maintaining the integrity of the SSH host's identity. Auditing and Remediation: The audit script verifies the permissions of all files ending in `.pub` located in `/etc/ssh/` to ensure they match the secure standard. The remediation script uses the `chmod` command to apply the correct octal permissions to these files, securing them against unauthorized modification. Recommended State Rationale: The recommended states are based on the principle of least privilege. Basic `['644']` (rw-r--r--) is the standard secure permission, preventing any user other than root from modifying the public keys. Moderate `['640']` (rw-r-----) improves on this by removing read access for 'others', limiting visibility of the key file to only the root user and its group, which reduces the local information disclosure attack surface. Strict is also `['640']`, as this is the most secure practical setting for a public key. More restrictive permissions, such as `600`, offer no significant security benefit for public data and could potentially interfere with SSH daemon operations that require group-level read access.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['644']` |
| **Moderate** | `['640']` |
| **Strict** | `['640']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that finds all SSH public host key files (files ending with .pub) in the `/etc/ssh/` directory and outputs the octal permission mode for each file. Each permission mode must be on a new line, with no other text or labels.

## Remediation Script Working

shell script that accepts a single positional argument representing the desired octal permission mode (e.g., '644'). The script must find all SSH public host key files (files ending with .pub) within the `/etc/ssh/` directory and apply the specified permissions to them. The script must output `true` if the operation is successful for all files, and `false` otherwise.

