# Ensure permissions on SSH public host key files are configured

Necessity: SSH public host key files are used by clients to verify the identity of the server, preventing man-in-the-middle (MITM) attacks. If these files are writable by unauthorized users, an attacker could replace the public key with their own, allowing them to impersonate the server and intercept sensitive data, including credentials. Enforcing correct, restrictive permissions is critical to maintaining the integrity of the host's identity. Auditing and Remediation: The audit script inspects each SSH public host key file (e.g., /etc/ssh/ssh_host_rsa_key.pub) and returns its current octal permissions. The remediation script uses the 'chmod' command to set the permissions on all these files to the specified value, ensuring they cannot be tampered with by non-administrative users. Recommended State Rationale: A permission setting of '644' (read/write for owner, read-only for group, read-only for others) is the industry standard and only secure configuration for these files. The root user (owner) requires write access to manage the keys, while all other users only need read access to verify the host's identity during an SSH connection. There is no security justification for a more lenient state, nor is a stricter state practical. Therefore, '644' is the required configuration for Basic, Moderate, and Strict security levels, as any deviation introduces a significant vulnerability.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['644']` |
| **Moderate** | `['644']` |
| **Strict** | `['644']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that locates all SSH public host key files (ssh_host_*.pub) within the /etc/ssh/ directory. The script must output a single, comma-separated string of the octal permissions for each file found. The output must contain only the permission values, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired octal file permissions (e.g., '644'). The script must find and apply these permissions using the 'chmod' command to all SSH public host key files (ssh_host_*.pub) located in the /etc/ssh/ directory. The script must return 'true' upon successful application to all files, or 'false' if any operation fails.

