Detections
Analytics

5.1.35 Ensure sshd X11UseLocalhost is enabled

Information

The SSH daemon must prevent remote hosts from connecting to the proxy display.

When X11 forwarding is enabled, there may be additional exposure to the server and client displays if the sshd proxy display is configured to listen on the wildcard address. By default, sshd binds the forwarding server to the loopback address and sets the hostname part of the DIPSLAY environment variable to localhost. This prevents remote hosts from connecting to the proxy display.

Solution

Configure the SSH daemon to prevent remote hosts from connecting to the proxy display.

Edit the /etc/ssh/sshd_config file to set the X11UseLocalhost parameter to yes above any Include and Match entries as follows:

X11UseLocalhost yes

Note: First occurrence of a option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.

See Also

https://workbench.cisecurity.org/benchmarks/19886

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, Rule-ID|SV-230556r951620_rule, Vuln-ID|V-230556

Plugin: Unix

Control ID: 3d633894f0223bd474556ee3891a446000e1d04f47e70102d3b8309c381e606b