Detections
Analytics

1.57 ESXI-80-000230

Information

The ESXi host Secure Shell (SSH) daemon must disable port forwarding.

GROUP ID: V-258785
RULE ID: SV-258785r959010

While enabling Transmission Control Protocol (TCP) tunnels is a valuable function of sshd, this feature is not appropriate for use on the ESXi hypervisor.

Solution

From an ESXi shell, run the following command:

esxcli system ssh server config set -k allowtcpforwarding -v no

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.ssh.server.config.set.CreateArgs()
$arguments.keyword = 'allowtcpforwarding'
$arguments.value = 'no'
$esxcli.system.ssh.server.config.set.Invoke($arguments)

See Also

https://workbench.cisecurity.org/benchmarks/23619

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-258785r959010_rule, STIG-ID|ESXI-80-000230, Vuln-ID|V-258785

Plugin: Unix

Control ID: ddaae0c12258bd7acb526a35c4308787e11c72896a0f3155c872028038ce8109