Ensure sshd DisableForwarding is enabled

НизкийУровень 2Автоматическаяazure-container-linux

Описание

The DisableForwarding parameter disables all forwarding features, including X11, ssh-agent(1), TCP and StreamLocal. This option overrides all other forwarding-related options and may simplify restricted configurations. • X11Forwarding provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections. • ssh-agent is a program to hold private keys used for public key authentication. Through use of environment variables the agent can be located and automatically used for authentication when logging in to other machines using ssh. • SSH port forwarding is a mechanism in SSH for tunneling application ports from the client to the server, or servers to clients. ...

Как проверяется

Метод проверки: Команда оболочки

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; command -v sshd >/dev/null 2>&1 || { echo "step1: sshd not installed"; return 1; }; o=$(bash -c 'sshd -T | grep -i disableforwarding' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'disableforwarding yes' || { echo step1: missing 'disableforwarding yes'; return 1; }; }; if alt0; then echo compliant; fi

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Edit the /etc/ssh/sshd_config file to set the DisableForwarding parameter to yes above any Include entry as follows: DisableForwarding yes Note: First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.

Свойства

Операционные системы: Любая
Теги: azure-container-linuxcis-converted
Источник: CIS Azure Container Linux Benchmark v1.0.0 - 5.2.10 Ensure sshd DisableForwarding is enabled

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target azure-container-linux --level 2