documentation_complete: true


title: 'Verify the SSH Private Key Files Have a Passcode'

description: |-
    When creating SSH key pairs, always use a passcode.
    <br />
    You can create such keys with the following command:
    <pre>$ sudo ssh-keygen -n [passphrase]</pre>
    {{{ full_name }}}, for certificate-based authentication, must enforce authorized access to the corresponding private key.

rationale: |-
    If an unauthorized user obtains access to a private key without a passcode,
    that user would have unauthorized access to any system where the associated
    public key has been installed.

severity: medium

identifiers:
  cce@rhel8: CCE-90781-6
  cce@rhel9: CCE-86553-5
  cce@rhel10: CCE-89160-6

references:
    srg: SRG-OS-000067-GPOS-00035
    stigid@ol8: OL08-00-010100

ocil_clause: 'no ssh private key is accessible without a passcode'

ocil: |-
    For each private key stored on the system, use the following command:
    <pre>$ sudo ssh-keygen -y -f /path/to/file</pre>
    If the contents of the key are displayed, this is a finding.
