documentation_complete: true

title: 'Do Not Allow SSH Environment Options'

description: |-
    To ensure users are not able to present
    environment options to the SSH daemon, add or correct the following line
    in <tt>/etc/ssh/sshd_config</tt>:
    <pre>PermitUserEnvironment no</pre>

rationale: |-
    SSH environment options potentially allow users to bypass
    access restriction in some configurations.

severity: unknown

identifiers:
    cce: 27201-3

references:
    disa: 1414
    srg: SRG-OS-000242
    stigid: RHEL-06-000241

ocil_clause: 'it is not'

ocil: |-
    To ensure users are not able to present environment daemons, run the following command:
    <pre>$ sudo grep PermitUserEnvironment /etc/ssh/sshd_config</pre>
    If properly configured, output should be:
    <pre>PermitUserEnvironment no</pre>
