# Ensure permissions on SSH private host key files are configured

Necessity: SSH private host keys are used to uniquely identify the server to connecting clients. If these files are readable by any user other than root, an attacker who gains unauthorized access to the system could copy these keys. With these keys, the attacker could impersonate the legitimate server in a Man-in-the-Middle (MitM) attack, allowing them to intercept, decrypt, and manipulate all traffic for connecting users, including capturing credentials and sensitive data. Proper permissions are critical to prevent key theft and server impersonation.

Auditing and Remediation: The audit script inventories all files matching the pattern `/etc/ssh/ssh_host_*_key`, checking their octal file permissions and user ownership against security best practices. The remediation script uses the `chmod` and `chown` commands to enforce the correct permissions and ownership on these critical key files, restricting access exclusively to the root user.

Recommended State Rationale: The Basic, Moderate, and Strict states are identical because there is only one secure configuration for SSH private host keys. Any deviation is a critical vulnerability. The recommended state of '600/root:root' is based on universal security standards, including CIS Benchmarks. The '600' permission set ensures that only the file's owner (root) has read and write access, while no other user or group can access the file content. The 'root:root' ownership ensures the SSH daemon, which starts with root privileges, is the only account that can access these keys, preventing unauthorized users from reading or modifying them.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['600/root:root']` |
| **Moderate** | `['600/root:root']` |
| **Strict** | `['600/root:root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that finds all SSH private host key files (matching `/etc/ssh/ssh_host_*_key`), and for each file found, outputs its permissions in octal mode and its owner, formatted as 'filename:permissions:owner'. Each file's details should be on a new line. The script should not produce any other text or headers.

## Remediation Script Working

Bash script that accepts a single command-line argument specifying the desired state for SSH private host key permissions and ownership, formatted as 'permissions/owner:group' (e.g., '600/root:root'). The script will find all files matching `/etc/ssh/ssh_host_*_key`, apply the specified permissions using `chmod`, and set the ownership using `chown`. It must output `true` on success or `false` if the argument is malformed or any command fails.

