11

I've read quite a few posts regarding the use of PermitUserEnvironment and the file ~/.ssh/environment in order to pass env variables to an ssh shell. The official sshd docs and a few other resources allude to some security risks of doing this.

Enabling environment processing may enable users to bypass access restrictions in some configurations using mechanisms such as LD_PRELOAD.

What are the likely security issue of activating PermitUserEnvironment? I was looking to hold DB connection details in these environment variables, is this advisable?

14

First of all, if you're not trying to do anything fancy with user access restrictions -- that is, if you're offering interactive shell access -- there are probably zero additional security risks in allowing use of the .ssh/environment file, since anything the user could accomplish with that file they could also do interactively in their shell.

Enabling environment processing may enable users to bypass access restrictions in some configurations using mechanisms such as LD_PRELOAD.

If you are using SSH forced commands to limit what people can do via ssh (for example, if you're restricting people to only using sftp or scp), allowing someone to set environment variables such as LD_PRELOAD (or possibly even PATH) would allow them to hijack your restrictions by replacing basic library calls with their own code. On the other hand, if you're creating the .ssh/environment on behalf of your users and they are not otherwise able to manage it, your risks are relatively small.

Without knowing more about your particular use case it's hard to provide a definitive answer.

  • I'm only allowing access to the server from 2 or 3 trusted parties (devs within our own organisation) via their rsa keys. So from what you're saying it sounds ok – Rob Squires Jul 31 '13 at 16:42
  • From your answer, I take it that I should not lose any sleep about security implications of enabling this option if all my ssh accounts provide full bash access (no sudo). Correct? – Florin Andrei Nov 15 '14 at 1:41
  • That's correct. If you're providing full bash access, people can already set whatever environment variables they want. – larsks Nov 15 '14 at 16:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.