Detections
Analytics

1.34 ESXI-80-000204

Information

The ESXi host Secure Shell (SSH) daemon must not permit user environment settings.

GROUP ID: V-258762
RULE ID: SV-258762r959010

SSH environment options potentially allow users to bypass access restriction in some configurations. Users must not be able to present environment options to the SSH daemon.

Solution

From an ESXi shell, run the following command:

esxcli system ssh server config set -k permituserenvironment -v no

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.ssh.server.config.set.CreateArgs()
$arguments.keyword = 'permituserenvironment'
$arguments.value = 'no'
$esxcli.system.ssh.server.config.set.Invoke($arguments)

See Also

https://workbench.cisecurity.org/benchmarks/23619

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-258762r959010_rule, STIG-ID|ESXI-80-000204, Vuln-ID|V-258762

Plugin: Unix

Control ID: d9a1f598f3e2827813ad1351a7d29081768099148786523cb9a979fb577e52b5