Description of problem:
This rule:
<xccdf-1.2:fix id="file_permissions_sshd_private_key" system="urn:xccdf:fix:script:puppet">include ssh_private_key_perms

Sets the permissions to 640 for /etc/ssh/*key

class ssh_private_key_perms {
  exec { 'sshd_priv_key':
    command =&gt; "chmod 0640 /etc/ssh/*_key",
    path    =&gt; '/bin:/usr/bin'
  }

Which then stops sshd from running because sshd does not want any permission on Group or Other.

Version-Release number of selected component (if applicable):
scap-security-guide-0.1.54-5.el8.noarch

How reproducible:
Everytime

Steps to Reproduce:
1. Apply the CIS profile
2. systemctl restart sshd

Actual results:
# systemctl restart sshd
  Job for sshd.service failed because the control process exited with error code.
  See "systemctl status sshd.service" and "journalctl -xe" for details.

# journalctl -xe
  -- Unit sshd.service has begun starting up.
  Sep 09 13:56:44 r8 sshd[747733]: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
  Sep 09 13:56:44 r8 sshd[747733]: @         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
  Sep 09 13:56:44 r8 sshd[747733]: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
  Sep 09 13:56:44 r8 sshd[747733]: Permissions 0640 for '/etc/ssh/ssh_host_rsa_key' are too open.
  Sep 09 13:56:44 r8 sshd[747733]: It is required that your private key files are NOT accessible by others.
  Sep 09 13:56:44 r8 sshd[747733]: This private key will be ignored.
  Sep 09 13:56:44 r8 sshd[747733]: Unable to load host key "/etc/ssh/ssh_host_rsa_key": bad permissions
  Sep 09 13:56:44 r8 sshd[747733]: Unable to load host key: /etc/ssh/ssh_host_rsa_key

Expected results:
The profile should not change the keys to 640. There appears to be caveats for other os's

template:
    name: file_permissions
    vars:
        filepath: /etc/ssh/
        missing_file_pass: 'true'
        file_regex: ^.*_key$
        filemode: '0640'
        filemode@sle12: '0600'
        filemode@sle15: '0600'
        filemode@ubuntu1604: '0600'
        filemode@ubuntu1804: '0600'
        filemode@ubuntu2004: '0600'

The default should be 600 instead of fixing this per os since the default is not a valid permission for sshd.

Additional info:
https://github.com/ComplianceAsCode/content/blob/086d4e74bb750c6e03958670fb2dcab4a8c2b582/linux_os/guide/services/ssh/file_permissions_sshd_private_key/rule.yml#L57

https://github.com/openssh/openssh-portable/blob/2dc328023f60212cd29504fc05d849133ae47355/authfile.c#L104