Set permissions on SSH public host keys

Description

SSH public host key files must have appropriate permissions to prevent unauthorized modification. The public keys under /etc/ssh/ are used by clients to verify the server's identity and must not be writable by unprivileged users.

Rationale

If an attacker can modify a server's SSH public host key files, they can replace them with keys whose corresponding private keys they control. Clients that trust the modified public key would then accept connections to an attacker-controlled server, enabling man-in-the-middle interception of credentials and session data.

Framework references

Live verification