cyberstrikeus Ensure sshd PermitUserEnvironment is disabled (Automated)
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Description
The PermitUserEnvironment option allows users to present environment options to the SSH daemon.
Rationale
Permitting users the ability to set environment variables through the SSH daemon could potentially allow users to bypass security controls (e.g. setting an execution path that has SSH executing trojan'd programs)
Audit Procedure
Command Line
Run the following command to verify PermitUserEnvironment is set to no:
# sshd -T | grep permituserenvironment
permituserenvironment no
Expected Result
permituserenvironment no
Remediation
Command Line
Edit the /etc/ssh/sshd_config file to set the PermitUserEnvironment parameter to no above any Include entries as follows:
PermitUserEnvironment no
Note: First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.
Default Value
PermitUserEnvironment no
References
- SSHD_CONFIG(5)
- NIST SP 800-53 Rev. 5: CM-1,CM-2, CM-6, CM-7, IA-5
- SSHD(8)
CIS Controls
v8 - 0.0 Explicitly Not Mapped
v7 - 0.0 Explicitly Not Mapped
MITRE ATT&CK Mappings: T1021 | TA0008 | M1042