# Ensure permissions on SSH private host key files are configured

Necessity: SSH private host keys are critical for authenticating the server's identity to connecting clients. If these files are accessible to unauthorized users, an attacker could copy them and impersonate the server in a man-in-the-middle (MitM) attack, allowing them to intercept and decrypt sensitive traffic. Unauthorized write access could lead to key replacement, causing a denial of service or facilitating a more sophisticated attack. Restricting permissions is essential to protect the integrity and confidentiality of SSH sessions.

Auditing and Remediation: The audit script systematically checks the ownership and permission settings for each private host key file found in `/etc/ssh/`, comparing them against the secure standard of `root` ownership and `600` permissions. The remediation script uses the `chown` and `chmod` commands to enforce these secure settings on all identified private key files, correcting any misconfigurations.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, Strict) is 'Compliant'. This is a binary control; the permissions are either secure or they are not. The Basic level requires adherence to the universally accepted security standard (CIS Benchmark recommendation) of `600` permissions, which allows read/write access only to the owner (root). There are no 'more secure' or 'less secure' states for this setting. Any deviation from this standard introduces a significant security risk, making 'Compliant' the only acceptable state across all hardening profiles.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Compliant']` |
| **Moderate** | `['Compliant']` |
| **Strict** | `['Compliant']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that locates all SSH private host key files (files matching the pattern `ssh_host_*_key`) in the `/etc/ssh/` directory. For each file found, the script must verify that the owner is 'root' and the file permissions are '600'. The script must output a single string: 'true' if all files meet these criteria, and 'false' otherwise. The output must not contain any other text.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired state (e.g., 'enforced'). The script must find all SSH private host key files (matching `ssh_host_*_key`) within `/etc/ssh/`. For each file, it must apply the following changes: set the owner to 'root' and set the file permissions to '600'. The script must return the string 'true' upon successful completion for all files, or 'false' if any operation fails.

