documentation_complete: true

title: 'Do Not Allow SSH Environment Options'

description: |-
    To ensure users are not able to override environment
    options to the SSH daemon, add or correct the following line
    in <tt>/etc/ssh/sshd_config</tt>:
    <pre>PermitUserEnvironment no</pre>

rationale: |-
    SSH environment options potentially allow users to bypass
    access restriction in some configurations.

severity: medium

identifiers:
    cce@rhel7: 27363-1

references:
    cis: 5.2.10
    cjis: 5.5.6
    cui: 3.1.12
    disa: 366
    hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)
    nist: CM-6(b)
    srg: SRG-OS-000480-GPOS-00229
    stigid@rhel7: "010460"

ocil_clause: 'PermitUserEnvironment is not disabled'

ocil: |-
    To ensure users are not able to present environment daemons, run the following command:
    <pre>$ sudo grep PermitUserEnvironment /etc/ssh/sshd_config</pre>
    If properly configured, output should be:
    <pre>PermitUserEnvironment no</pre>
