← Back to VMware vSphere 7.0 ESXi Security Technical Implementation Guide

V-256388

CAT II (Medium)

The ESXi host Secure Shell (SSH) daemon must not permit user environment settings.

Rule ID

SV-256388r959010_rule

STIG

VMware vSphere 7.0 ESXi Security Technical Implementation Guide

Version

V1R4

CCIs

CCI-000366

Discussion

SSH environment options potentially allow users to bypass access restriction in some configurations. Users must not be able to present environment options to the SSH daemon.

Check Content

From an ESXi shell, run the following command:

# /usr/lib/vmware/openssh/bin/sshd -T|grep permituserenvironment

Expected result:

permituserenvironment no

If the output does not match the expected result, this is a finding.

Fix Text

From an ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":

PermitUserEnvironment no