TMA-AZURE-CONTAINER-LINUX-5.2.10

Ensure sshd DisableForwarding is enabled

NiskaNivo 2Automatskaazure-container-linux

Opis

The DisableForwarding parameter disables all forwarding features, including X11, ssh-agent(1), TCP and StreamLocal. This option overrides all other forwarding-related options and may simplify restricted configurations. • X11Forwarding provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections. • ssh-agent is a program to hold private keys used for public key authentication. Through use of environment variables the agent can be located and automatically used for authentication when logging in to other machines using ssh. • SSH port forwarding is a mechanism in SSH for tunneling application ports from the client to the server, or servers to clients. ...

Kako se proverava

Metod provere: Komanda ljuske

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; command -v sshd >/dev/null 2>&1 || { echo "step1: sshd not installed"; return 1; }; o=$(bash -c 'sshd -T | grep -i disableforwarding' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'disableforwarding yes' || { echo step1: missing 'disableforwarding yes'; return 1; }; }; if alt0; then echo compliant; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Edit the /etc/ssh/sshd_config file to set the DisableForwarding parameter to yes above any Include entry as follows: DisableForwarding yes Note: First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.

Svojstva

Operativni sistemi: Bilo koji
Oznake: azure-container-linuxcis-converted
Referenca: CIS Azure Container Linux Benchmark v1.0.0 - 5.2.10 Ensure sshd DisableForwarding is enabled

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target azure-container-linux --level 2