Detections
Analytics

5.1.22 Ensure sshd PermitUserEnvironment is disabled

Information

The PermitUserEnvironment option allows users to present environment options to the SSH daemon.

Permitting users the ability to set environment variables through the SSH daemon could potentially allow users to bypass security controls (e.g. setting an execution path that has SSH executing trojan'd programs)

Solution

Edit the /etc/ssh/sshd_config file to set the PermitUserEnvironment parameter to no above any Include entries as follows:

PermitUserEnvironment no

Note: First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.

See Also

https://workbench.cisecurity.org/benchmarks/19886

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, CAT|II, Rule-ID|SV-230330r951610_rule, STIG-ID|RHEL-08-010830, Vuln-ID|V-230330

Plugin: Unix

Control ID: e652d447e8e0b86fae59f072b7efdab249850100ce9b7bb4f68cb7982cc7746d