Host SSH daemon, if enabled, must not allow use of gateway ports

보통레벨 1자동vmware

설명

When enabled, the SSH daemon on the host should have the gateway ports feature disabled to prevent remote hosts from forwarding connections. This is a hardening measure to ensure that the SSH service is securely configured against potential forwarding misuses. The audit reads /etc/ssh/sshd_config and requires GatewayPorts no (unset = OpenSSH default no). Runs in the ESXi Shell (busybox sh) as root.

점검 방법

감사 방식: 셸 명령

shell

f=/etc/ssh/sshd_config; [ -r "$f" ] || exit 1
v=$(awk 'tolower($1)=="gatewayports" {print tolower($2); exit}' "$f")
case "$v" in '') echo compliant ;; no) echo compliant ;; *) echo "GatewayPorts $v" ;; esac

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

To remediate this recommendation, set GatewayPorts no in the supported ESXi SSH configuration. Restart SSH only during an authorized maintenance/admin window and verify the effective setting.

속성

운영 체제: 모두
태그: vmwareesxiservices
참고 자료: CIS VMware ESXi 8.0 Benchmark v1.4.0 - 6.5.3 Host SSH daemon, if enabled, must not allow use of gateway ports

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target vmware