Detections
Analytics

4.2.8 Ensure sshd DisableForwarding is enabled

Information

The DisableForwarding parameter disables all forwarding features, including X11, ssh-agent(1), TCP, and StreamLocal. This option overrides all other forwarding-related options and may simplify restricted configurations.

 - X11Forwarding allows tunneling X11 traffic through the connection to enable remote graphic connections.
 - ssh-agent is a program that holds private keys used for public key authentication. Environment variables allow the agent to be located and automatically used for authentication when logging in to other machines using SSH.SSH port forwarding is a mechanism in SSH for tunneling application ports from the client to the server or servers to clients. It can be used to add encryption to legacy applications and pass through firewalls. Some system administrators and IT professionals use it to open backdoors into the internal network from their home machines.

Disable X11 forwarding unless there is an operational requirement to use X11 applications directly. There is a small risk that other users on the X11 server could compromise the remote X11 servers of users who are logged in via SSH with X11 forwarding. Even if X11 forwarding is disabled, users can always install their forwarders.

Anyone with root privileges on the intermediate server can use ssh-agent to authenticate to other servers for free.

Leaving port forwarding enabled can expose the organization to security risks and backdoors. SSH connections are protected with strong encryption. This makes their contents invisible to most deployed network monitoring and traffic filtering solutions. This invisibility carries considerable potential risk if used for malicious purposes such as data exfiltration. Cybercriminals or malware could exploit SSH to hide their unauthorized communications or to exfiltrate stolen data from the target network.

Solution

Edit the /etc/ssh/sshd_config file to set the parameter above any Include entries as follows:

DisableForwarding yes

Impact:

SSH tunnels are widely used in many corporate environments. In some environments, the applications themselves may have very limited native security support. By tunneling, compliance with SOX, HIPAA, PCI-DSS, and other standards can be achieved without modifying the applications.

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 1548f242cbc96580005850baa41a05545daa6b0c48584f9463324d033f0f1e39