Verify Ownership on SSH Server Public *.pub Key Files
Ensures the SSH configuration and host-key directory /etc/ssh is owned by root (uid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/ssh directory holds the SSH server's host keys, both private and public (*.pub). The public host keys are what clients pin to detect server impersonation. If a non-root user owns this directory, they can replace a public key, or the private key it pairs with, enabling a man-in-the-middle attack where clients silently trust a rogue server. Keeping /etc/ssh owned by root (uid 0) ensures only the superuser can touch the keys that anchor SSH trust.
What Pavois checks
Pavois asserts that the live directory /etc/ssh has owner uid 0, skipped via only_if if it is absent. It reads the effective owner from the filesystem (stat), so a manual chown on the directory that holds the host keys is caught even if no config-management tool reports drift.
describe command('find /etc/ssh -name "ssh_host_*_key.pub" -type f ! -uid 0 2>/dev/null') do
its('stdout.strip') { should eq '' }
endHow to verify it is applied
Run stat -c '%U %u' /etc/ssh. Expected output: root 0. To check the key files too, run find /etc/ssh -name '*.pub' -not -user root and find /etc/ssh -name 'ssh_host_*_key' -not -user root, both should print nothing.
Inspect & investigate
Ownership has no continuous log; query it with stat /etc/ssh. SSH service activity and key-related warnings appear in /var/log/auth.log (Debian/Ubuntu) or via journalctl -u ssh; sshd refuses to start if it deems host-key ownership/permissions unsafe, and that error is logged there.
Remediation
No automated harden plan is defined, so apply it manually: chown root:root /etc/ssh and, to cover the contents, chown root:root /etc/ssh/*.pub (public keys) while leaving private host keys as root-owned mode 0600. Reinstalling openssh-server also restores correct ownership.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | chown root /etc/ssh/ssh_host_*_key.pub 2>/dev/null || true |
|---|---|
| name | chown-sshd-pub-keys |
| not_if | [ -z "$(find /etc/ssh -name 'ssh_host_*_key.pub' -type f ! -uid 0 2>/dev/null)" ] |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner of /etc/ssh can subvert host-key trust and enable man-in-the-middle attacks against everyone who connects. Restoring root ownership is safe and does not interrupt existing SSH sessions. Precaution: do not relax permissions while fixing ownership, private host keys must stay mode 0600 root:root, or sshd will refuse to start; verify with sshd -t after any change, and keep a second session or console open in case sshd needs a restart.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
| CIS | 5.1.2, 5.1.3, 5.1.4, 5.1.5 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.