# Ensure permissions on /etc/ssh/sshd_config are configured

Necessity: The `/etc/ssh/sshd_config` file contains all the configuration settings for the SSH daemon, which manages remote access to the system. Improper permissions on this file could allow unauthorized users to view or modify the server's security configuration. A malicious actor could alter the file to weaken security protocols, allow insecure authentication methods, or disable logging, potentially leading to unauthorized system access, privilege escalation, or concealment of illicit activities.

Auditing and Remediation: The audit script uses the `stat` command to retrieve the current access permissions (in octal format), the owner user, and the owner group of the `/etc/ssh/sshd_config` file. The remediation script takes the desired state as an argument and uses the `chmod` and `chown` commands to set the file permissions and ownership to the specified secure values.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly '600 root root'. This is because there is no secure alternative; any deviation from this standard introduces significant risk. This configuration adheres to the principle of least privilege: Permissions '600' ensure that only the owner can read and write the file. Ownership by 'root:root' ensures that only the superuser has control over the SSH service's configuration. This is a foundational security best practice cited by numerous security frameworks, including the CIS Benchmarks, as it prevents non-privileged users from tampering with or discovering sensitive remote access configurations.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['600 root root']` |
| **Moderate** | `['600 root root']` |
| **Strict** | `['600 root root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that executes `stat -c "%a %u %g" /etc/ssh/sshd_config` to check the permissions, owner, and group of the SSH daemon configuration file. The script must output only the resulting string (e.g., '600 root root') without any extra text or formatting.

## Remediation Script Working

Bash script that accepts a single string argument in the format 'permissions owner group' (e.g., '600 root root'). The script must use `chmod` to set the file permissions and `chown` to set the owner and group for `/etc/ssh/sshd_config`. The script must return 'true' upon successful application of all changes and 'false' if any operation fails.

