VMWare ESXi 5.0 Server Security Technical Implementation Guide

The VMWare ESXi 5.0 Server Security Technical Implementation Guide (V2 R1) has 133 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

133STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R1

CurrentPublished Wed Oct 27 2021

The SSH client must be configured to not allow TCP forwarding.

VMWare ESXi 5.0 Server Security Technical Implementation Guide

Assessment Title

Rule Text

The SSH client must be configured to not allow TCP forwarding.

Description

Discussion Text

SSH TCP connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide similar convenience to a Virtual Private Network (VPN) with the similar risk of providing a path to circumvent firewalls and network ACLs.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-250592

Rule

SV-250592r798775_rule

Severity

low

Rule Version

GEN005516-ESXI5-703

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Disable lock down mode. Enable the ESXi Shell. Execute the following command(s):
# grep Forward /etc/ssh/ssh_config

Re-enable lock down mode.

If any of the following attributes (ForwardAgent, ForwardX11, or ForwardX11Trusted) exist and are not set to "no", this is a finding. If the /etc/ssh/ssh_config file does not exist, this is not a finding.

Implementation Procedure

Fix Text

Disable lock down mode. Enable the ESXi Shell. Execute the following command(s):
# vi /etc/ssh/ssh_config

Add/modify the attribute line entry to the following (quotes for emphasis only):
"ForwardAgent no"
"ForwardX11 no"
"ForwardX11Trusted no"

Re-enable lock down mode.

STIG check 51 of 133 in the VMWare ESXi 5.0 Server STIG checklist

← Previous · V-250591The SSH daemon must be configured to not allow TCP connection forwarding.Next · V-250593 →The SSH daemon must be configured to not allow gateway ports.