0034-ssh-keys-authorized_keys Public Key Changes¶

Rule ID¶

• 0034-ssh-keys

Category¶

• system

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• Monitor changes to public keys in the authorized_keys file on the host.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• authorized_keys is a critical file for SSH passwordless login. If a malicious key is added, it can lead to data leakage or hacker penetration.

Risk Items¶

• Hacker penetration

• Data leakage

• Network security

• Cryptomining risk

• Botnet risk

Audit Method¶

• Verify whether the host's authorized_keys file has been illegally modified. You can run the following command to verify:

ls /root/.ssh/authorized_keys && ls /home/*/.ssh/authorized_keys

Remediation¶

• If the host's authorized_keys has been illegally modified, please be sure to carefully inspect the host environment to determine whether it has been compromised, and change the host user password.

Impact¶

• None

Default Value¶

• None

References¶

• Hacker intrusion emergency response ideas and processes (Unofficial)

• Record of a real cryptomining intrusion analysis (Unofficial)

CIS Controls¶

• None