Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-215301 | AIX7-00-002118 | SV-215301r508663_rule | Medium |
Description |
---|
SSH TCP connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide similar convenience to a Virtual Private Network (VPN) with the similar risk of providing a path to circumvent firewalls and network ACLs. |
STIG | Date |
---|---|
IBM AIX 7.x Security Technical Implementation Guide | 2023-05-17 |
Check Text ( C-16499r294354_chk ) |
---|
If TCP forwarding is approved for use by the ISSO, this is not applicable. Check the SSH daemon configuration for the "AllowTcpForwarding" directive using command: # grep -i AllowTcpForwarding /etc/ssh/sshd_config | grep -v '^#' AllowTcpForwarding no If the setting is not present or the setting is "yes", this is a finding. |
Fix Text (F-16497r294355_fix) |
---|
Edit the "/etc/sshd/sshd_config" file to add the following line and save the change: AllowTcpForwarding no Restart the SSH daemon: # stopsrc -s sshd # startsrc -s sshd |