diff --git a/meta-openeuler/recipes-core/openssh/openssh/config/common/sshd_check_keys b/meta-openeuler/recipes-core/openssh/openssh/config/common/sshd_check_keys
index 1931dc715375f2ec6b7ad356cb1240add98cf8ce..dbd5074386321f3d83cf437feb588cff709f877c 100644
--- a/meta-openeuler/recipes-core/openssh/openssh/config/common/sshd_check_keys
+++ b/meta-openeuler/recipes-core/openssh/openssh/config/common/sshd_check_keys
@@ -25,6 +25,7 @@ generate_key() {
     sync "${FILE}.pub" "$DIR" "${FILE}.tmp"
 
     mv "${FILE}.tmp" "$FILE"
+    chmod 400 "$FILE"
 
     # sync to ensure the atomic rename is committed
     sync "$DIR"
diff --git a/meta-openeuler/recipes-core/os-base/os-base_1.0.bb b/meta-openeuler/recipes-core/os-base/os-base_1.0.bb
index 82521a72fd00af61efcbae0813dc3a6ced1af1fb..e32abb8290b474af15e25bae75d6034669570f97 100644
--- a/meta-openeuler/recipes-core/os-base/os-base_1.0.bb
+++ b/meta-openeuler/recipes-core/os-base/os-base_1.0.bb
@@ -15,7 +15,6 @@ SRC_URI = "file://bashrc \
 	file://issue \
 	file://issue.net \
 	file://LICENSE \
-	file://login.defs \
 	file://motd \
 	file://passwd \
 	file://profile \
@@ -34,8 +33,7 @@ do_install() {
 	cp ${WORKDIR}/inittab  		${D}/etc/
 	cp ${WORKDIR}/issue  		${D}/etc/
 	cp ${WORKDIR}/issue.net  	${D}/etc/
-	cp ${WORKDIR}/login.defs  	${D}/etc/
-	cp ${WORKDIR}/motd  		${D}/etc/
+	cp ${WORKDIR}/motd		${D}/etc/
 	cp ${WORKDIR}/passwd  		${D}/etc/
 	cp ${WORKDIR}/profile  		${D}/etc/
 	cp ${WORKDIR}/securetty  	${D}/etc/
diff --git a/meta-openeuler/recipes-core/os-base/os-base/login.defs b/meta-openeuler/recipes-core/shadow/files/login.defs
similarity index 100%
rename from meta-openeuler/recipes-core/os-base/os-base/login.defs
rename to meta-openeuler/recipes-core/shadow/files/login.defs
diff --git a/meta-openeuler/recipes-core/shadow/shadow.inc b/meta-openeuler/recipes-core/shadow/shadow.inc
index d227de122c9b3eccbacd7ab3e85bb3d23034edb4..86bb18f4c193b7e07a098749555926da184c4211 100644
--- a/meta-openeuler/recipes-core/shadow/shadow.inc
+++ b/meta-openeuler/recipes-core/shadow/shadow.inc
@@ -79,7 +79,9 @@ SRC_URI += "file://pam.d/chfn \
                file://pam.d/newusers \
                file://pam.d/passwd \
                file://pam.d/su  \
-               file://pam.d/groupmems"
+               file://pam.d/groupmems \
+               file://login.defs \
+	    "
 
 do_install() {
         oe_runmake DESTDIR="${D}" sbindir="${base_sbindir}" usbindir="${sbindir}" install
@@ -169,6 +171,7 @@ do_install_append() {
         # Handle link properly after rename, otherwise missing files would
         # lead rpm failed dependencies.
         ln -sf newgrp.${BPN} ${D}${bindir}/sg
+        cp ${WORKDIR}/login.defs ${D}${sysconfdir}/
 }
 
 PACKAGES =+ "${PN}-base"