cyberstrikeus 9.3.10 Do Not Allow Users to Set Environment Options (Scored)
Profile Applicability
- Level 1
Description
The PermitUserEnvironment option allows users to present environment options to the ssh daemon.
Rationale
Permitting users the ability to set environment variables through the SSH daemon could potentially allow users to bypass security controls (e.g. setting an execution path that has ssh executing trojan'd programs).
Audit Procedure
Using Command Line
To verify the correct SSH setting, run the following command and verify that the output is as shown:
grep PermitUserEnvironment /etc/ssh/sshd_config
Expected Result
PermitUserEnvironment no
Remediation
Using Command Line
Edit the /etc/ssh/sshd_config file to set the parameter as follows:
PermitUserEnvironment no
Default Value
PermitUserEnvironment no
References
- CIS Ubuntu 12.04 LTS Server Benchmark v1.1.0
Profile
Level 1 - Scored