UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

AIX must turn off TCP forwarding for the SSH daemon.


Overview

Finding ID Version Rule ID IA Controls Severity
V-215301 AIX7-00-002118 SV-215301r508663_rule Medium
Description
SSH TCP connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide similar convenience to a Virtual Private Network (VPN) with the similar risk of providing a path to circumvent firewalls and network ACLs.
STIG Date
IBM AIX 7.x Security Technical Implementation Guide 2023-05-17

Details

Check Text ( C-16499r294354_chk )
If TCP forwarding is approved for use by the ISSO, this is not applicable.

Check the SSH daemon configuration for the "AllowTcpForwarding" directive using command:

# grep -i AllowTcpForwarding /etc/ssh/sshd_config | grep -v '^#'
AllowTcpForwarding no

If the setting is not present or the setting is "yes", this is a finding.
Fix Text (F-16497r294355_fix)
Edit the "/etc/sshd/sshd_config" file to add the following line and save the change:
AllowTcpForwarding no

Restart the SSH daemon:
# stopsrc -s sshd
# startsrc -s sshd