3

I've just discovered ~/.ssh/environment and the PermitUserEnvironment setting in OpenSSH Server. It works great for setting variables to literal strings; e.g.:

# host ~/.ssh/environment
PATH=/home/rlue/.local/bin:/usr/local/bin:/usr/bin:/bin:/usr/games

# client
$ ssh host 'echo $PATH'
/home/rlue/.local/bin:/usr/local/bin:/usr/bin:/bin:/usr/games

but variable expansion does not work:

# host ~/.ssh/environment
PATH=/home/rlue/.local/bin:$PATH

# client
$ ssh host 'echo $PATH'
/home/rlue/.local/bin:$PATH

I've found multiple questions that address this topic, with differing answers about whether variable expansion should work or not:

The author of that last post said he confirmed he got it working with the same version of OpenSSH server that I'm running (1:7.9p1-10+deb10u2 on Debian stable), but I followed his directions to the letter and I'm still getting a literal $PATH (i.e., no variable expansion).

Does anyone have a definitive answer re: whether it's supposed to work, and if so, what my configuration is missing?

Ryan Lue
  • 1,076
  • You should not enable PermitUserEnvironment -- that's a very dangerous setting which allows users to bypass their login shell and ForcedCommand, and may also trip other security assumptions. Users can safely and easily set environment variables in their initialization scripts, there's no need to use PermitUserEnvironment at all, ever. –  Nov 05 '20 at 05:28
  • Same goes for AcceptEnv. –  Nov 05 '20 at 05:30
  • If your intention is to set an envvar only in shells run via ssh, you can do it with if [ "$SSH_CONNECTION" ]; then export PATH=$PATH:/foo/bar; fi or similar. –  Nov 05 '20 at 05:49
  • @user414777: Given "ssh host command", which user initialization scripts are used before the command is executed? – None Jan 09 '22 at 15:30

1 Answers1

3

Checking the source code, the relevant functions are read_environment_file() in session.c and child_set_env() in misc.c. These are simple functions - just read lines of the form var=value and set them, checking for limits and validity, but without doing any additional processing of the values. That's also what the manpage says:

Additionally, ssh reads ~/.ssh/environment, and adds lines of the format “VARNAME=value” to the environment if the file exists and users are allowed to change their environment.

So, no, it's not supposed to, going by documentation or by code.

muru
  • 72,889