Detections
Analytics

GEN005515-ESXI5-000100 - The SSH daemon must be configured to not allow TCP connection forwarding.

Information

SSH TCP connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide similar convenience to a Virtual Private Network (VPN) with the similar risk of providing a path to circumvent firewalls and network ACLs.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Disable lock down mode.
Enable the ESXi Shell.

Edit the SSH daemon configuration and add/modify the 'AllowTCPForwarding' configuration setting it to 'no'.
# vi /etc/ssh/sshd_config

Re-enable lock down mode.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_ESXi5_Server_V2R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Group-ID|V-39248, Rule-ID|SV-250591r798772_rule, STIG-ID|GEN005515-ESXI5-000100, STIG-Legacy|SV-51064, STIG-Legacy|V-39248, Vuln-ID|V-250591

Plugin: VMware

Control ID: 45ac6f53df217bb51e72474c81f524603d251fc502a18143b7af29e9325ec079