Detections
Analytics

1.331 ALMA-09-043030

Information

AlmaLinux OS 9 must not allow users to override SSH environment variables.

GROUP ID: V-269439
RULE ID: SV-269439r1050322

SSH environment options potentially allow users to bypass access restriction in some configurations.

Solution

To configure the system to prevent users from overriding SSH environment variables, add or modify the following line in "/etc/ssh/sshd_config":

PermitUserEnvironment no

Alternatively, add the setting to an include file if the line "Include /etc/ssh/sshd_config.d/*.conf" is found at the top of the "/etc/ssh/sshd_config" file:

$ echo "PermitUserEnvironment no" > /etc/ssh/sshd_config.d/environment.conf

Restart the SSH daemon for the settings to take effect:

$ systemctl restart sshd.service

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-8(2), CCI|CCI-002420, Rule-ID|SV-269439r1050322_rule, STIG-ID|ALMA-09-043030, Vuln-ID|V-269439

Plugin: Unix

Control ID: ebd2df8c88f306fedace820202483dc9b50ebb59ca56e9d5430393aaa37c6f66