Detections
Analytics

GEN005520-ESXI5-705 - The SSH client must be configured to not allow X11 forwarding.

Information

X11 forwarding over SSH allows for the secure remote execution of X11-based applications. This feature can increase the attack surface of an SSH connection and should not be enabled unless needed.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Disable lock down mode.
Enable the ESXi Shell.

Edit the SSH client configuration and add/modify the 'ForwardX11' configuration to 'no'.
# vi /etc/ssh/ssh_config

Re-enable lock down mode.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_ESXi5_Server_V2R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Group-ID|V-39271, Rule-ID|SV-250596r798787_rule, STIG-ID|GEN005520-ESXI5-705, STIG-Legacy|SV-51087, STIG-Legacy|V-39271, Vuln-ID|V-250596

Plugin: VMware

Control ID: 3e7612b4cf04edf2eb775b3f92409bfa405e65414ece9c3ffbfcc5bbbf652528