UCF STIG Viewer Logo

The SSH daemon must be configured to not allow TCP connection forwarding.


Overview

Finding ID Version Rule ID IA Controls Severity
V-39248 GEN005515-ESXI5-000100 SV-51064r1_rule Low
Description
SSH TCP connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide similar convenience to a Virtual Private Network (VPN) with the similar risk of providing a path to circumvent firewalls and network ACLs.
STIG Date
VMware ESXi Server 5.0 Security Technical Implementation Guide 2017-01-06

Details

Check Text ( C-46512r1_chk )
Disable lock down mode.
Enable the ESXi Shell. Check the SSH daemon configuration for the TCP connection forwarding setting. # grep -i AllowTCPForwarding /etc/ssh/sshd_config | grep -v '^#'

If "AllowTCPForwarding" is set to "yes", this is a finding.

Re-enable lock down mode.
Fix Text (F-44227r1_fix)
Disable lock down mode.
Enable the ESXi Shell.

Edit the SSH daemon configuration and add/modify the "AllowTCPForwarding" configuration setting it to "no".
# vi /etc/ssh/sshd_config

Re-enable lock down mode.