UCF STIG Viewer Logo

The SSH daemon must not permit tunnels.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22480 GEN005531 SV-26774r1_rule ECSC-1 Medium
Description
OpenSSH has the ability to create network tunnels (layer-2 and layer-3) over an SSH connection. This function can provide similar convenience to a Virtual Private Network (VPN) with the similar risk of providing a path to circumvent firewalls and network ACLs.
STIG Date
VMware ESX 3 Server 2016-05-13

Details

Check Text ( C-27782r1_chk )
Check the SSH daemon configuration for the PermitTunnel setting.
# grep -i PermitTunnel /etc/ssh/sshd_config | grep -v '^#'
If the setting is not present, or set to yes, this is a finding.
Fix Text (F-24024r1_fix)
Edit the SSH daemon configuration and add or edit the PermitTunnel setting value to no.