The Photon operating system must be configured to protect the Secure Shell (SSH) public host key from unauthorized modification.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-258895	PHTN-40-000233	SV-258895r933746_rule		Medium

Description
If a public host key file is modified by an unauthorized user, the SSH service may be compromised.

STIG	Date
VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide	2023-10-29

Details

Check Text ( C-62635r933744_chk )
At the command line, run the following command: # stat -c "%n permissions are %a and owned by %U:%G" /etc/ssh/*key.pub Example result: /etc/ssh/ssh_host_dsa_key.pub permissions are 644 and owned by root:root /etc/ssh/ssh_host_ecdsa_key.pub permissions are 644 and owned by root:root /etc/ssh/ssh_host_ed25519_key.pub permissions are 644 and owned by root:root /etc/ssh/ssh_host_rsa_key.pub permissions are 644 and owned by root:root If any "key.pub" file listed is not owned by root or not group owned by root or does not have permissions of "0644", this is a finding.

Check Text ( C-62635r933744_chk )

At the command line, run the following command:

# stat -c "%n permissions are %a and owned by %U:%G" /etc/ssh/*key.pub

Example result:

/etc/ssh/ssh_host_dsa_key.pub permissions are 644 and owned by root:root
/etc/ssh/ssh_host_ecdsa_key.pub permissions are 644 and owned by root:root
/etc/ssh/ssh_host_ed25519_key.pub permissions are 644 and owned by root:root
/etc/ssh/ssh_host_rsa_key.pub permissions are 644 and owned by root:root

If any "key.pub" file listed is not owned by root or not group owned by root or does not have permissions of "0644", this is a finding.

Fix Text (F-62544r933745_fix)
At the command line, run the following commands for each returned file: # chmod 644 # chown root:root # systemctl restart sshd.service