Detections
Analytics

GEN005530-ESXI5-000107 - The SSH daemon must not permit user environment settings.

Information

SSH may be used to provide limited functions other than an interactive shell session, such as file transfer. If local, user-defined environment settings (such as, those configured in ~/.ssh/authorized_keys and ~/.ssh/environment) are configured by the user and permitted by the SSH daemon, they could be used to alter the behavior of the limited functions, potentially granting unauthorized access to the system.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Disable lock down mode. Enable the ESXi Shell. Execute the following command(s):
# vi /etc/ssh/sshd_config

Add/modify the attribute line entry to the following (quotes for emphasis only):
'PermitUserEnvironment no'

Re-enable lock down mode.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_ESXi5_Server_V2R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Group-ID|V-39267, Rule-ID|SV-250599r798796_rule, STIG-ID|GEN005530-ESXI5-000107, STIG-Legacy|SV-51083, STIG-Legacy|V-39267, Vuln-ID|V-250599

Plugin: VMware

Control ID: 584740be41b2b33e9a6e6d1afa719ec4c72dc4738c2b0aabf68fb862c48a01a1