documentation_complete: true

title: 'Verify Ownership on SSH Server Public *.pub Key Files'

description: |-
    SSH server public keys, files that match the <code>/etc/ssh/*.pub</code> glob, must be owned
    by <code>root</code> user.

rationale: |-
    If a public host key file is modified by an unauthorized user, the SSH service
    may be compromised.

severity: medium

identifiers:
    cce@rhel8: CCE-86129-4
    cce@rhel9: CCE-86130-2
    cce@rhel10: CCE-87297-8

ocil_clause: '{{{ ocil_clause_file_owner(file="/etc/ssh/*.pub", owner="root") }}}'

ocil: |-
    {{{ ocil_file_owner(file="/etc/ssh/*.pub", owner="root") }}}

template:
    name: file_owner
    vars:
        filepath:
            - /etc/ssh/
        file_regex:
            - ^.*\.pub$
        uid_or_name: '0'

warnings:
    - general: |-
        Remediation is not possible at bootable container build time because SSH host
        keys are generated post-deployment.

platform: system_with_kernel
