SV-260529r1208685_rule
V-260529
SRG-OS-000480-GPOS-00227
UBTU-22-255040
CAT I
10
Configure the SSH server to disable X11 forwarding.
Add or modify the following line in the "/etc/ssh/sshd_config" file:
X11Forwarding no
Restart SSH for the changes to take effect:
$ sudo systemctl restart ssh
Verify that X11 forwarding is disabled by using the following command:
$ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'x11forwarding'
/etc/ssh/sshd_config:X11Forwarding no
If "X11Forwarding" is set to "yes" and is not documented with the information system security officer (ISSO) as an operational requirement, is commented out, is missing, or conflicting results are returned, this is a finding.
V-260529
False
UBTU-22-255040
Verify that X11 forwarding is disabled by using the following command:
$ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'x11forwarding'
/etc/ssh/sshd_config:X11Forwarding no
If "X11Forwarding" is set to "yes" and is not documented with the information system security officer (ISSO) as an operational requirement, is commented out, is missing, or conflicting results are returned, this is a finding.
M
5594