UCF STIG Viewer Logo

The ESXi host Secure Shell (SSH) daemon must be configured to not allow gateway ports.


Finding ID Version Rule ID IA Controls Severity
V-256391 ESXI-70-000022 SV-256391r885954_rule Low
SSH Transmission Control Protocol (TCP) connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide convenience similar to a virtual private network (VPN) with the similar risk of providing a path to circumvent firewalls and network Access Control Lists (ACLs). Gateway ports allow remote forwarded ports to bind to nonloopback addresses on the server.
VMware vSphere 7.0 ESXi Security Technical Implementation Guide 2023-06-21


Check Text ( C-60066r885952_chk )
From an ESXi shell, run the following command:

# /usr/lib/vmware/openssh/bin/sshd -T|grep gatewayports

Expected result:

gatewayports no

If the output does not match the expected result, this is a finding.
Fix Text (F-60009r885953_fix)
From an ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":

GatewayPorts no