OpenControls Logo

STIG Viewer

STIGViewer Support

RHEL 10 must be configured so that Secure Shell (SSH) public host key files have mode "0644" or less permissive.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-281253RHEL-10-700500SV-281253r1184654_ruleCCI-002696medium
Description
If a public host key file is modified by an unauthorized user, the SSH service may be compromised.
STIGDate
Red Hat Enterprise Linux 10 Security Technical Implementation Guide2026-03-11

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CHG-06Control Functionality Verification
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (14) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-3(4)Discretionary Access Control
1.00
AU-12Audit Record Generation
1.00
AU-3Content of Audit Records
1.00
AU-3(1)Additional Audit Information
1.00
AU-8Time Stamps
1.00
AU-9Protection of Audit Information
1.00
CM-3(5)Automated Security Response
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-5(6)Limit Library Privileges
1.00
CM-7(2)Prevent Program Execution
1.00

+4 more (top 10 by confidence shown)

CCI1 mapping
CCI-002696
1.00

Details

Check Text (C-281253r1184654_chk)

Verify RHEL 10 SSH public host key files have a mode of "0644" or less permissive with the following command: Note: SSH public key files may be found in other directories on the system depending on the installation. $ sudo stat -c "%a %n" /etc/ssh/*.pub 644 /etc/ssh/ssh_host_dsa_key.pub 644 /etc/ssh/ssh_host_ecdsa_key.pub 644 /etc/ssh/ssh_host_ed25519_key.pub 644 /etc/ssh/ssh_host_rsa_key.pub If any "key.pub" file has a mode more permissive than "0644", this is a finding.

Fix Text (F-85719r1166710_fix)

Configure RHEL 10 SSH public host key files to have mode "0644" or less permissive. Change the mode of public host key files under "/etc/ssh" to "0644" with the following command: $ sudo chmod 0644 /etc/ssh/*key.pub Restart the SSH daemon with the following command for the changes to take effect: $ sudo systemctl restart sshd.service