Ensure sshd DisableForwarding is enabled

СреднийУровень 1Автоматическаяlinux

Описание

The DisableForwarding parameter disables all forwarding features, including X11, ssh-agent(1), TCP and StreamLocal. This option overrides all other forwarding-related options and may simplify restricted configurations. • X11Forwarding provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections. • ssh-agent is a program to hold private keys used for public key authentication. Through use of environment variables the agent can be located and automatically used for authentication when logging in to other machines using ssh. • SSH port forwarding is a mec

Как проверяется

Метод проверки: Команда оболочки

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; command -v sshd >/dev/null 2>&1 || { echo "step1: sshd not installed"; return 1; }; o=$(bash -c 'sshd -T | grep -i disableforwarding' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'disableforwarding yes' || { echo step1: missing 'disableforwarding yes'; return 1; }; }; if alt0; then echo compliant; fi

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Edit the /etc/ssh/sshd_config file to set the DisableForwarding parameter to yes above any Include entry as follows: DisableForwarding yes Note: First occurrence of an option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.

Свойства

Операционные системы: rhel-10
Теги: cis-convertedlinux
Источник: CIS Red Hat Enterprise Linux 10 Benchmark v1.0.1 - 5.1.8

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target linux