The ESXi host Secure Shell (SSH) daemon must not permit user environment settings.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-258762	SRG-OS-000480-VMM-002000	ESXI-80-000204	SV-258762r933347_rule	2023-10-11	1

Description
SSH environment options potentially allow users to bypass access restriction in some configurations. Users must not be able to present environment options to the SSH daemon.

ℹ️ Check
From an ESXi shell, run the following command: # esxcli system ssh server config list -k permituserenvironment or From a PowerCLI command prompt while connected to the ESXi host, run the following commands: $esxcli = Get-EsxCli -v2 $esxcli.system.ssh.server.config.list.invoke() \| Where-Object {$_.Key -eq 'permituserenvironment'} Example result: permituserenvironment no If "permituserenvironment" is not configured to "no", this is a finding.

ℹ️ Check

From an ESXi shell, run the following command: # esxcli system ssh server config list -k permituserenvironment or From a PowerCLI command prompt while connected to the ESXi host, run the following commands: $esxcli = Get-EsxCli -v2 $esxcli.system.ssh.server.config.list.invoke() | Where-Object {$_.Key -eq 'permituserenvironment'} Example result: permituserenvironment no If "permituserenvironment" is not configured to "no", this is a finding.

✔️ Fix
From an ESXi shell, run the following command: # esxcli system ssh server config set -k permituserenvironment -v no or From a PowerCLI command prompt while connected to the ESXi host, run the following commands: $esxcli = Get-EsxCli -v2 $arguments = $esxcli.system.ssh.server.config.set.CreateArgs() $arguments.keyword = 'permituserenvironment' $arguments.value = 'no' $esxcli.system.ssh.server.config.set.Invoke($arguments)

✔️ Fix

From an ESXi shell, run the following command: # esxcli system ssh server config set -k permituserenvironment -v no or From a PowerCLI command prompt while connected to the ESXi host, run the following commands: $esxcli = Get-EsxCli -v2 $arguments = $esxcli.system.ssh.server.config.set.CreateArgs() $arguments.keyword = 'permituserenvironment' $arguments.value = 'no' $esxcli.system.ssh.server.config.set.Invoke($arguments)