TMA-COS-5.1.12
Ensure SSH PermitUserEnvironment is disabled
MediumLevel 1Automatedcos
Description
The PermitUserEnvironment option allows users to present environment options to the ssh daemon. Permitting users the ability to set environment variables through the SSH daemon could potentially allow users to bypass security controls (e.g. setting an execution path that has ssh executing trojan'd programs)
How it is checked
Audit method: Shell command
shell
alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; command -v sshd >/dev/null 2>&1 || { echo "step1: sshd not installed"; return 1; }; o=$(bash -c 'sshd -T | grep permituserenvironment' 2>&1); printf '%s\n' "$o" | tr -s ' \t' ' ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'PermitUserEnvironment no' || { echo step1: missing 'PermitUserEnvironment no'; return 1; }; }; if alt0; then echo compliant; fi- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Edit the /etc/ssh/sshd_config file to set the parameter as follows: PermitUserEnvironment no
Properties
- Operating systems
- Any
- Tags
- container-optimized-oscosssh
- Reference
- CIS Google Container-Optimized OS Benchmark v1.2.0 - 5.1.12 Ensure SSH PermitUserEnvironment is disabled
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target cos