Set environment variables for non-interactive ssh

Question

Where is the most appropriate place to set environment variables for all (including non-interactive) ssh sessions, and for all users (including root)?

I believe that it may be in a script under /etc/profile.d/, but I'm not confident that making a change there won't adversely affect something else in my configuration.

Answer 1

From the sshd(8) man page, FILES section:

 ~/.ssh/environment
         This file is read into the environment at login (if it exists).
         It can only contain empty lines, comment lines (that start with
         ‘#’), and assignment lines of the form name=value.  The file
         should be writable only by the user; it need not be readable by
         anyone else.  Environment processing is disabled by default and
         is controlled via the PermitUserEnvironment option.

Answer 2

In sshd_config, you could set e.g.

ForceCommand /usr/local/bin/setsshenv

where setsshenv looks something like this:

#!/bin/bash
export VAR1=value1
export VAR2=value2
...
exec $SSH_ORIGINAL_COMMAND

I'm not sure if this would run before or after users' ~/.ssh/environment scripts were read.