Host SSH daemon, if enabled, must disable stream local forwarding

보통레벨 1자동vmware

설명

Disabling stream local forwarding on the SSH daemon ensures that no Unix domain sockets are forwarded, thus enforcing a security boundary. This measure aids in maintaining the integrity and confidentiality of the system. The audit reads /etc/ssh/sshd_config and requires AllowStreamLocalForwarding no. Runs in the ESXi Shell (busybox sh) as root.

점검 방법

감사 방식: 셸 명령

shell

f=/etc/ssh/sshd_config; [ -r "$f" ] || exit 1
v=$(awk 'tolower($1)=="allowstreamlocalforwarding" {print tolower($2); exit}' "$f")
case "$v" in '') echo 'AllowStreamLocalForwarding not set' ;; no) echo compliant ;; *) echo "AllowStreamLocalForwarding $v" ;; esac

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

To remediate this recommendation, set AllowStreamLocalForwarding no, restart SSH if authorized, and verify stream-local forwarding cannot be established.

속성

운영 체제: 모두
태그: vmwareesxiservices
참고 자료: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 6.5.9 Host SSH daemon, if enabled, must disable stream local forwarding

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target vmware