ESXI-70-000022 - The ESXi host Secure Shell (SSH) daemon must be configured to not allow gateway ports.

Information

SSH Transmission Control Protocol (TCP) connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide convenience similar to a virtual private network (VPN) with the similar risk of providing a path to circumvent firewalls and network Access Control Lists (ACLs). Gateway ports allow remote forwarded ports to bind to nonloopback addresses on the server.

Solution

From an ESXi shell, add or correct the following line in '/etc/ssh/sshd_config':

GatewayPorts no

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y23M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-256391r885954_rule, STIG-ID|ESXI-70-000022, Vuln-ID|V-256391

Plugin: Unix

Control ID: e8d5194b4ef703ff5801fe6e4a949255fc7e538bb4d7a958d58cd4854f2d0844