Replace ssh_keys group with root, where applicable and use less permissive file mode

[rndmh3ro]

In Fedora 38, the ssh_keys group was removed. root is used now, in accordance to upstream.

See: https://www.spinics.net/lists/fedora-devel/msg307707.html
See: https://src.fedoraproject.org/rpms/openssh/pull-request/37#

[schurzi]

There seems to be an issue with idempotency in Fedora. This seems related to this change.
This change makes us compatible to Fedora 38, how will we handle older Fedora releases? Can we reasonably expect users to upgrade, or should we introduce something, that at least supports all currently meintained Fedora releases? According to https://endoflife.date/fedora there is still Fedora 37 for 6 months.

[rndmh3ro]

Fedora changes the permissions from the host keys from our 640 to 600 after restarting sshd. I think that's good. So we should probably change our hardening default to 600, which makes it more secure.

What do you think?

[schurzi]

What do you think?

Seems like a good idea. Reading our code, this seems also relevant for RHEL:

ansible-collection-hardening/roles/ssh_hardening/tasks/crypto_hostkeys.yml

Lines 11 to 12 in 9c86dae

	# In RHEL and Fedora, the 'ssh_keys' group is the group owner of the host private SSH keys.
	# Since the openssh_keypair module needs to read the key to provide idempotency, we need to set ownership and group based on specific OS vars.

For RHEL it should be easy to cover the different versions, but the issue with tracking Fedora versions still persists.

[schurzi]

I did some digging in STIG docs:
It seems the root group is also supported with RHEL9:
https://www.stigviewer.com/stig/red_hat_enterprise_linux_8/2022-12-06/finding/V-230287
https://static.open-scap.org/ssg-guides/ssg-rhel9-guide-stig_gui.html#xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key

So I think we should keep it as is for RHEL <9 and Fedora <38 and use the more secure root:root and 600 set for all newer releases. Setting this as a default for the OS and overriding it in the more specific vars for older releases should cover this.

[rndmh3ro]

For RHEL it should be easy to cover the different versions, but the issue with tracking Fedora versions still persists.

I'm not really fond of creating a new docker-image and supporting it for every fedora release (two every year). So if anyone wants to do this for the forseeable future, then I'm fine with it. But for now I only want to support the latest release.

[schurzi]

seems good. Maybe we can even use 600 for all cases, since the rationale was that this is more secure.
Also we only do this when the distribution is RedHat so all values for other OSes are of no consequence.

[rndmh3ro]

Maybe we can even use 600 for all cases, since the rationale was that this is more secure.

Yes, I'll change that.

Also we only do this when the distribution is RedHat so all values for other OSes are of no consequence.

Is there anything speaking against doing this for all OSes?

[schurzi]

Is there anything speaking against doing this for all OSes?

I think this is a very good idea. And also think we should extend the task to cover all private keys, not only the ssh_host_rsa_key. Maybe switch the order of tasks, so we have a fact for all available host keys.