Detections
Analytics

6.5.10 Host SSH daemon, if enabled, must disable TCP forwarding

Information

Disabling TCP forwarding in the SSH daemon is a measure to prevent potential unauthorized tunneling and forwarding activities that could lead to data leaks or unauthorized data access. This measure adds a layer of security to the SSH service when enabled, making the system more resilient against certain types of network attacks.

Preventing TCP forwarding aids in ensuring that the SSH daemon is not misused for unauthorized tunneling. This measure assists in maintaining a more secure and controlled network environment.

Solution

To remediate this recommendation, set AllowTcpForwarding no, restart SSH if authorized, and test that TCP forwarding is blocked. Document any approved exception.

Impact:

No functional impact has been reported. This indicates that disabling TCP forwarding is a precautionary measure that does not interfere with the normal operation of the host.

See Also

https://workbench.cisecurity.org/benchmarks/28124

Item Details

Category: CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|CM-7, 800-53|MA-4, CSCv7|5.1

Plugin: Unix

Control ID: f79a226805bf6c5b7f43129887a76bbe3bf0a104634af1b83eb6c0b338dddf61