Protect the SSH server configuration and host keys

Description

The OpenSSH server reads its configuration from /etc/ssh/sshd_config and the drop-in files of /etc/ssh/sshd_config.d/, and proves its identity with the host private keys /etc/ssh/ssh_host_*_key. This control requires all of them to belong to root:root, the configuration and private keys with mode 0600 at most, the drop-in directory 0755 at most, and the public keys 0644 at most.

Debian creates host private keys with mode 0600 and sshd_config with 0644. Files written by the other SSH fixes of this standard (00-cirsec.conf) are covered too, which is why this control comes last among them.

Rationale

A copy of a host private key lets an attacker on the network path pose as the server without any warning on the clients, and collect passwords or hijack sessions. Write access to the configuration is equivalent to root access at the next reload. Read access shows which accounts and methods are allowed, which helps target an attack.

Impact

Users other than root can no longer read sshd_config; sshd -T already needs root.

Applies when

Detected: when: OpenSSH server is installed A scanner reports the control not applicable when one is false.

Setting

Audit

Run stat -c '%n %U:%G %a' /etc/ssh/sshd_config /etc/ssh/sshd_config.d /etc/ssh/sshd_config.d/*.conf /etc/ssh/ssh_host_*. Every entry must be root:root; sshd_config, the .conf drop-ins and the private keys at most 600, the directory at most 755, the .pub files at most 644.

Automated: every check must pass. Scanners report each check by its id.

sshd-config

Main SSH server configuration.

path: /etc/ssh/sshd_config
owner: root
group: root
mode: '0600'

dropin-dir

Drop-in configuration directory.

path: /etc/ssh/sshd_config.d
owner: root
group: root
mode: '0755'

dropins

Drop-in configuration files.

path: /etc/ssh/sshd_config.d/*.conf
owner: root
group: root
mode: '0600'

private-keys

Host private keys.

path: /etc/ssh/ssh_host_*_key
owner: root
group: root
mode: '0600'

public-keys

Host public keys.

path: /etc/ssh/ssh_host_*_key.pub
owner: root
group: root
mode: '0644'

Remediation

chown root:root /etc/ssh/sshd_config /etc/ssh/sshd_config.d /etc/ssh/sshd_config.d/*.conf /etc/ssh/ssh_host_*
chmod 600 /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf /etc/ssh/ssh_host_*_key
chmod go-w /etc/ssh/sshd_config.d
chmod 644 /etc/ssh/ssh_host_*_key.pub

Rollback

Restore the previous modes with chmod 644 /etc/ssh/sshd_config (Debian default).

sshd-config

Generated from check sshd-config: the engine writes the fix for every output, it sets the expected value and the check runs again after.

dropin-dir

Generated from check dropin-dir: the engine writes the fix for every output, it sets the expected value and the check runs again after.

dropins

Generated from check dropins: the engine writes the fix for every output, it sets the expected value and the check runs again after.

private-keys

Generated from check private-keys: the engine writes the fix for every output, it sets the expected value and the check runs again after.

public-keys

Generated from check public-keys: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• sshd(8), Debian manual pages (FILES) Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R50) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle