Ensure sshd PermitUserEnvironment is disabled

MediaNivel 1Automatizadaaix

Descripción

The PermitUserEnvironment option allows users to present environment options to the SSH daemon. Permitting users the ability to set environment variables through the SSH daemon could potentially allow users to bypass security controls (e.g. setting an execution path that has SSH executing trojan'd programs) Audit: evaluates the effective configuration from `sshd -T` (Match blocks must be reviewed separately).

Cómo se verifica

Método de auditoría: Comando de shell

shell

command -v sshd >/dev/null 2>&1 || exit 1; out=$(sshd -T 2>/dev/null) || exit 1; r=compliant; for p in '^permituserenvironment[[:blank:]]+no$'; do printf '%s\n' "$out" | grep -Eiq -- "$p" || r="not matched: $p"; done; echo "$r"

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Edit the /etc/ssh/sshd_config file to set the parameter: PermitUserEnvironment no Re-cycle the sshd daemon to pick up the configuration changes: stopsrc -s sshd startsrc -s sshd

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: aixssh
Referencia: CIS IBM AIX 7 Benchmark v1.2.0 - 4.6.3.16 Ensure sshd PermitUserEnvironment is disabled

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target aix