Detections
Analytics

1.36 ESXI-80-000209

Information

The ESXi host Secure Shell (SSH) daemon must not permit tunnels.

GROUP ID: V-258764
RULE ID: SV-258764r959010

OpenSSH has the ability to create network tunnels (layer 2 and layer 3) over an SSH connection. This function can provide similar convenience to a virtual private network (VPN) with the similar risk of providing a path to circumvent firewalls and network Access Control Lists (ACLs).

Solution

From an ESXi shell, run the following command:

esxcli system ssh server config set -k permittunnel -v no

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.ssh.server.config.set.CreateArgs()
$arguments.keyword = 'permittunnel'
$arguments.value = 'no'
$esxcli.system.ssh.server.config.set.Invoke($arguments)

See Also

https://workbench.cisecurity.org/benchmarks/23619

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-258764r959010_rule, STIG-ID|ESXI-80-000209, Vuln-ID|V-258764

Plugin: Unix

Control ID: ff01fa909ad8c6bb89e5fa2d863f778e13f970d7f1607a34a1491ae7ce0fabde