Detections
Analytics

GEN005517-ESXI5-000101 - The SSH daemon must be configured to not allow gateway ports.

Information

SSH TCP connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide similar convenience to a Virtual Private Network (VPN) with the similar risk of providing a path to circumvent firewalls and network ACLs. Gateway ports allow remote forwarded ports to bind to non-loopback addresses on the server.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Disable lock down mode. Enable the ESXi Shell. Execute the following command(s):
# vi /etc/ssh/sshd_config

Add/modify the attribute line entry to the following (quotes for emphasis only):
'GatewayPorts no'

Re-enable lock down mode.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_ESXi5_Server_V2R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Group-ID|V-39250, Rule-ID|SV-250593r798778_rule, STIG-ID|GEN005517-ESXI5-000101, STIG-Legacy|SV-51066, STIG-Legacy|V-39250, Vuln-ID|V-250593

Plugin: VMware

Control ID: 622aa9783ec03080ec6fc53f46fca42dbadfab91ae7d9afe778a3c179fc8bc8f