STIGQter: STIG Summary: Microsoft Windows Server 2025 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

Windows Server 2025 OpenSSH private host key files must conform to minimum requirements.

DISA Rule

SV-285321r1211191_rule

Vulnerability Number

V-285321

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

WN25-SH-000090

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Maintain the permissions of the private host key files as follows:

BUILTIN\Administrators:(F)
NT AUTHORITY\SYSTEM:(F)

Check Contents

If OpenSSH is not installed on the system, this requirement is not applicable.

Verify the SSH private host key files permissions with the following command:

C:\ > Get-ChildItem -Path "C:\ProgramData\ssh" -Filter "*_key" -File | ForEach-Object { icacls.exe $_.FullName }

C:\ProgramData\ssh\ssh_host_ecdsa_key BUILTIN\Administrators:(F)
NT AUTHORITY\SYSTEM:(F)

Successfully processed 1 files; Failed processing 0 files
C:\ProgramData\ssh\ssh_host_ed25519_key BUILTIN\Administrators:(F)
NT AUTHORITY\SYSTEM:(F)

Successfully processed 1 files; Failed processing 0 files
C:\ProgramData\ssh\ssh_host_rsa_key BUILTIN\Administrators:(F)
NT AUTHORITY\SYSTEM:(F)

Successfully processed 1 files; Failed processing 0 files

If any private host key file does not have the default permission as in the example output, this is a finding.

Vulnerability Number

V-285321

Documentable

False

Rule Version

WN25-SH-000090

Severity Override Guidance

If OpenSSH is not installed on the system, this requirement is not applicable.

Verify the SSH private host key files permissions with the following command:

C:\ > Get-ChildItem -Path "C:\ProgramData\ssh" -Filter "*_key" -File | ForEach-Object { icacls.exe $_.FullName }

C:\ProgramData\ssh\ssh_host_ecdsa_key BUILTIN\Administrators:(F)
NT AUTHORITY\SYSTEM:(F)

Successfully processed 1 files; Failed processing 0 files
C:\ProgramData\ssh\ssh_host_ed25519_key BUILTIN\Administrators:(F)
NT AUTHORITY\SYSTEM:(F)

Successfully processed 1 files; Failed processing 0 files
C:\ProgramData\ssh\ssh_host_rsa_key BUILTIN\Administrators:(F)
NT AUTHORITY\SYSTEM:(F)

Successfully processed 1 files; Failed processing 0 files

If any private host key file does not have the default permission as in the example output, this is a finding.

Check Content Reference

M

Target Key

5719