# Ensure sshd PermitUserEnvironment is disabled

Necessity: The 'PermitUserEnvironment' setting controls whether sshd processes environment variable settings from user-controlled files like `~/.ssh/environment` and `environment=` options in `~/.ssh/authorized_keys`. Enabling this feature poses a significant security risk, as it allows users to set potentially dangerous environment variables (such as LD_PRELOAD or LD_LIBRARY_PATH). A malicious actor could exploit this to load arbitrary libraries, bypass security controls, and potentially escalate privileges. Disabling it reduces the attack surface by preventing user-controlled environment manipulation during SSH sessions.

Auditing and Remediation: The audit script inspects the active SSH server configuration to determine the current state of the 'PermitUserEnvironment' directive. The remediation script modifies the '/etc/ssh/sshd_config' file to explicitly set 'PermitUserEnvironment' to the desired state (typically 'no') and then reloads the SSH service to enforce the change.

Recommended State Rationale: The recommended state across all levels (Basic, Moderate, and Strict) is 'no'. This is a binary security setting where the only secure configuration, as advised by security standards like the CIS Benchmarks, is to have it disabled. There is no valid use case in a hardened environment for allowing users this level of control over the session environment, as the risk of misuse far outweighs any potential convenience. Therefore, it should be disabled under all circumstances to maintain a secure posture.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['no']` |
| **Moderate** | `['no']` |
| **Strict** | `['no']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script to query the live SSH daemon configuration for the 'PermitUserEnvironment' setting. The script should use 'sshd -T' to get the effective configuration and parse the output to return only the current value (e.g., 'no' or 'yes'), with no extra text or labels.

## Remediation Script Working

Bash script that accepts a single positional argument ('yes' or 'no') to set the 'PermitUserEnvironment' directive in '/etc/ssh/sshd_config'. The script must correctly uncomment, modify an existing line, or add the line if it does not exist. After modifying the file, it must restart the sshd service to apply the change. It must output 'true' on successful completion or 'false' if an error occurs.

