documentation_complete: true

title: 'Verify Group Ownership on SSH Server Private *_key Key Files'

{{% set dedicated_ssh_groupname = groups.get("dedicated_ssh_keyowner", {}).get("name") %}}

description: |-
    SSH server private keys, files that match the <code>/etc/ssh/*_key</code> glob, must be
    group-owned by <code>{{{ dedicated_ssh_groupname if dedicated_ssh_groupname else 'root' }}}</code> group.

rationale: |-
    If an unauthorized user obtains the private SSH host key file, the host could be impersonated.

severity: medium

identifiers:
    cce@rhel8: CCE-86126-0
    cce@rhel9: CCE-86127-8
    cce@rhel10: CCE-90288-2

ocil_clause: '{{{ ocil_clause_file_group_owner(file="/etc/ssh/*_key", group="root") }}}'

ocil: |-
    {{{ ocil_file_group_owner(file="/etc/ssh/*_key", group="root") }}}

template:
    name: file_groupowner
    vars:
        filepath:
            - /etc/ssh/
        file_regex:
            - ^.*_key$
        gid_or_name: '{{{ dedicated_ssh_groupname if dedicated_ssh_groupname else '0' }}}'

warnings:
    - general: |-
        Remediation is not possible at bootable container build time because SSH host
        keys are generated post-deployment.

platform: system_with_kernel
