cis-ubuntu1204-v110-9-3-10

name	cis-ubuntu1204-v110-9-3-10
description	Do Not Allow Users to Set Environment Options
category	cis-os-hardening
version	1.1.0
author	cyberstrike-official
tags	["cis","ubuntu",12.04,"linux","authentication","ssh","environment"]
cis_id	9.3.10
cis_benchmark	CIS Ubuntu 12.04 LTS Server Benchmark v1.1.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

9.3.10 Do Not Allow Users to Set Environment Options (Scored)

Profile Applicability

• Level 1

Description

The PermitUserEnvironment option allows users to present environment options to the ssh daemon.

Rationale

Permitting users the ability to set environment variables through the SSH daemon could potentially allow users to bypass security controls (e.g. setting an execution path that has ssh executing trojan'd programs).

Audit Procedure

Using Command Line

To verify the correct SSH setting, run the following command and verify that the output is as shown:

grep PermitUserEnvironment /etc/ssh/sshd_config

Expected Result

PermitUserEnvironment no

Remediation

Using Command Line

Edit the /etc/ssh/sshd_config file to set the parameter as follows:

PermitUserEnvironment no

Default Value

PermitUserEnvironment no

References

• CIS Ubuntu 12.04 LTS Server Benchmark v1.1.0

Profile

Level 1 - Scored