The ESXi host Secure Shell (SSH) daemon must not permit user environment settings.

SSH environment options potentially allow users to bypass access restriction in some configurations. Users must not be able to present environment options to the SSH daemon.

From an ESXi shell, run the following command:

# /usr/lib/vmware/openssh/bin/sshd -T|grep permituserenvironment

Expected result:

permituserenvironment no

If the output does not match the expected result, this is a finding.

From an ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":

PermitUserEnvironment no