Verify Group Ownership on SSH Server Public *.pub Key Files
Ensures the SSH host public-key location /etc/ssh is owned by group root (gid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The SSH host public keys (/etc/ssh/ssh_host_*_key.pub) are presented to clients to verify the server's identity. If an unauthorized user can modify a public key file, the SSH service can be compromised, for example a swapped public key paired with a rogue private key enables host impersonation. Group ownership by root (gid 0) prevents non-privileged users from tampering with these files.
What Pavois checks
Pavois reads the real group id of /etc/ssh via InSpec's file resource and asserts gid == 0. It checks the effective ownership on disk, so a regenerated .pub file (e.g. after ssh-keygen -A) that landed with the wrong group is detected even when the deployment manifest still looks correct.
describe command('find /etc/ssh -name "ssh_host_*_key.pub" -type f ! -gid 0 2>/dev/null') do
its('stdout.strip') { should eq '' }
endHow to verify it is applied
Run stat -c '%G %g' /etc/ssh (expected root 0) and check the public keys: stat -c '%n %G %a' /etc/ssh/ssh_host_*_key.pub, they should be group root with mode 0644.
Inspect & investigate
Add an auditd watch, auditctl -w /etc/ssh -p wa -k sshd_keys, to record ownership or content changes in /var/log/audit/audit.log. SSH daemon start-up and host-key loading is logged via journalctl -u sshd / /var/log/auth.log.
Remediation
No automated remediation is wired for this rule, so it must be applied manually: chgrp 0 /etc/ssh (and the *.pub files within it). Re-run pavois harden verify afterwards.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | chgrp root /etc/ssh/ssh_host_*_key.pub 2>/dev/null || true |
|---|---|
| name | chgrp-sshd-pub-keys |
| not_if | [ -z "$(find /etc/ssh -name 'ssh_host_*_key.pub' -type f ! -gid 0 2>/dev/null)" ] |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If public host keys can be modified by a non-root group, an attacker can substitute keys and enable host impersonation. Resetting the group to root is safe, public keys are world-readable (0644) by design, so SSH clients and the daemon keep working. No session impact. Precaution: do not confuse these with the private keys, which on some distros use the ssh_keys group; only the .pub files and the directory should be group root here.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
| CIS | 5.1.3, 5.1.5 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.