← Back to Oracle Linux 8 Security Technical Implementation Guide

V-248650

CAT I (High)

OL 8 must not allow users to override SSH environment variables.

Rule ID

SV-248650r991591_rule

STIG

Oracle Linux 8 Security Technical Implementation Guide

Version

V2R8

CCIs

CCI-000366

Discussion

SSH environment options potentially allow users to bypass access restriction in some configurations.

Check Content

Verify that unattended or automatic login via SSH is disabled with the following command:

$ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permituserenvironment'

PermitUserEnvironment no

If "PermitUserEnvironment" is set to "yes", is missing completely, or is commented out, this is a finding.

If conflicting results are returned, this is a finding.

Fix Text

Configure OL 8 to allow the SSH daemon to not allow unattended or automatic login to the system. 
 
Add or edit the following line in the "/etc/ssh/sshd_config" file: 
 
PermitUserEnvironment no 
 
The SSH daemon must be restarted for the changes to take effect. To restart the SSH daemon, run the following command: 
 
$ sudo systemctl restart sshd.service