UCF STIG Viewer Logo

The SSH client must be configured to not allow gateway ports.


Overview

Finding ID Version Rule ID IA Controls Severity
V-39251 GEN005518-ESXI5-704 SV-51067r2_rule Low
Description
SSH TCP connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide similar convenience to a Virtual Private Network (VPN) with the similar risk of providing a path to circumvent firewalls and network ACLs. Gateway ports allow remote forwarded ports to bind to non-loopback addresses on the server.
STIG Date
VMware ESXi Server 5.0 Security Technical Implementation Guide 2017-01-06

Details

Check Text ( C-46515r2_chk )
Disable lock down mode.
Enable the ESXi Shell. Check the SSH client configuration for the gateway ports setting.
# grep -i GatewayPorts /etc/ssh/ssh_config | grep -v '^#'

If "GatewayPorts" is set to "yes", this is a finding. If the /etc/ssh/ssh_config file does not exist, this is not a finding.

Re-enable lock down mode.
Fix Text (F-44230r1_fix)
Disable lock down mode.
Enable the ESXi Shell. Edit the SSH client configuration and add/modify the "GatewayPorts" configuration, setting it to "no".
# vi /etc/ssh/ssh_config

Re-enable lock down mode.