Detections
Analytics

ESXI-80-000230 - The ESXi host Secure Shell (SSH) daemon must disable port forwarding.

Information

While enabling Transmission Control Protocol (TCP) tunnels is a valuable function of sshd, this feature is not appropriate for use on the ESXi hypervisor.

Solution

From an ESXi shell, run the following command:

# esxcli system ssh server config set -k allowtcpforwarding -v no

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.ssh.server.config.set.CreateArgs()
$arguments.keyword = 'allowtcpforwarding'
$arguments.value = 'no'
$esxcli.system.ssh.server.config.set.Invoke($arguments)

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_8-0_Y25M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-258785r959010_rule, STIG-ID|ESXI-80-000230, Vuln-ID|V-258785

Plugin: Unix

Control ID: a14d6b6ae04f8969c88bb750e36ff1f5dde68d0279cb7d460cfb4610078d6d0f