RHEL 9 must not allow users to override SSH environment variables.

Documentable No

Rule ID SV-257993r1045049_rule

CCI References

CCI-000366

Discussion

SSH environment options potentially allow users to bypass access restriction in some configurations.

Check Procedure

Verify that unattended or automatic logon via SSH is disabled with the following command:

$ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permituserenvironment'

PermitUserEnvironment no

If "PermitUserEnvironment" is set to "yes", is missing completely, or is commented out, this is a finding.

If the required value is not set, this is a finding.

Fix Action

Configure the RHEL 9 SSH daemon to not allow unattended or automatic logon to the system by editing the following line in the "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d":

PermitUserEnvironment no

Restart the SSH daemon  for the setting to take effect:

$ sudo systemctl restart sshd.service