UCF STIG Viewer Logo

The SSH client must not permit tunnels.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22481 GEN005532 SV-46096r1_rule ECSC-1 Medium
Description
OpenSSH has the ability to create network tunnels (layer-2 and layer-3) over an SSH connection. This function can provide similar convenience to a Virtual Private Network (VPN) with the similar risk of providing a path to circumvent firewalls and network ACLs.
STIG Date
SUSE Linux Enterprise Server v11 for System z 2012-12-13

Details

Check Text ( C-43352r1_chk )
Check the SSH client configuration for the Tunnel setting.
# grep -i Tunnel /etc/ssh/ssh_config | grep -v '^#'
If the setting is present and not set to "no", this is a finding.
Fix Text (F-39439r1_fix)
Edit the SSH client configuration to remove the "Tunnel" setting or set the value to "no".