Profile Applicability:
 • Level 1

Description:
 The PermitUserEnvironment option in the SSH daemon (sshd) configuration allows users to set environment variables via the .ssh/environment file. Disabling this option prevents users from modifying their login environment in potentially insecure ways.

Rationale:
 Disabling PermitUserEnvironment reduces security risks by preventing users from altering environment variables that could be exploited to bypass security restrictions or execute unauthorized commands.

Impact:
 Pros:

  • Enhances SSH security by limiting user-controlled environment modifications.

  • Helps prevent privilege escalation or unauthorized command execution.

Cons:

  • May limit legitimate use cases that require environment variable customization.

Default Value:
 PermitUserEnvironment is typically disabled by default but should be verified.

Pre-requisites:

  • Root or sudo privileges to modify SSH daemon configuration.

Remediation:

Test Plan:

Using Linux command line:

Check current PermitUserEnvironment setting in /etc/ssh/sshd_config:

grep ^PermitUserEnvironment /etc/ssh/sshd_config

  1. Verify it is set to no or the directive is commented out.

Implementation Plan:

Using Linux command line:

Edit /etc/ssh/sshd_config:
vi /etc/ssh/sshd_config
Set PermitUserEnvironment to no:
PermitUserEnvironment no
Save the file and restart sshd:
systemctl restart sshd

Confirm the setting:

grep ^PermitUserEnvironment /etc/ssh/sshd_config

Backout Plan:

Using Linux command line:

  1. Set PermitUserEnvironment to yes if necessary.

  2. Restart sshd and verify behavior.

References: