Ensure sshd DisableForwarding is enabled

FaibleNiveau 2Automatiséeazure-container-linux

Description

The DisableForwarding parameter disables all forwarding features, including X11, ssh-agent(1), TCP and StreamLocal. This option overrides all other forwarding-related options and may simplify restricted configurations. • X11Forwarding provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections. • ssh-agent is a program to hold private keys used for public key authentication. Through use of environment variables the agent can be located and automatically used for authentication when logging in to other machines using ssh. • SSH port forwarding is a mechanism in SSH for tunneling application ports from the client to the server, or servers to clients. ...

Méthode de vérification

Méthode d'audit: Commande shell

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; command -v sshd >/dev/null 2>&1 || { echo "step1: sshd not installed"; return 1; }; o=$(bash -c 'sshd -T | grep -i disableforwarding' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'disableforwarding yes' || { echo step1: missing 'disableforwarding yes'; return 1; }; }; if alt0; then echo compliant; fi

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Edit the /etc/ssh/sshd_config file to set the DisableForwarding parameter to yes above any Include entry as follows: DisableForwarding yes Note: First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: azure-container-linuxcis-converted
Référence: CIS Azure Container Linux Benchmark v1.0.0 - 5.2.10 Ensure sshd DisableForwarding is enabled

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target azure-container-linux --level 2