Detections
Analytics

6.5.12 Host SSH daemon, if enabled, must not permit user environment settings

Information

Preventing user environment settings in the SSH daemon ensures a consistent and controlled environment, reducing the attack surface by limiting the customization of the SSH environment by users.

Disallowing user environment settings within the SSH daemon reduces the potential for malicious or inadvertent misconfiguration, thus enhancing the security posture.

Solution

To remediate this recommendation, set PermitUserEnvironment no, restart SSH if authorized, and verify users cannot alter the SSH environment through per-user environment settings.

Impact:

There is no functional impact noted, indicating that restricting user environment settings does not adversely affect the operational aspects of the host.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|CM-7, 800-53|MA-4, CSCv7|5.1

Plugin: Unix

Control ID: 595064e32092d82a6596c0428ea2e55578e86cbb742087f362463aae2bcdb8a4