Description
DisableForwarding yes in the OpenSSH server turns off every kind of forwarding at once: TCP
port forwarding (ssh -L, -R, -D), Unix socket forwarding, X11 forwarding and SSH agent
forwarding, whatever the other *Forwarding options say.
Rationale
With forwarding, a user or an attacker holding any SSH account can open tunnels to internal services that the firewall does not expose, or expose the server's network to the outside (reverse tunnels). X11 and agent forwarding let a compromised server act on the client's display or reuse its keys.
Impact
Administrators lose ssh -L/-R/-D tunnels, ssh -A (agent forwarding, used to hop to other
hosts or to git with the local key) and ssh -X. To reach other hosts, use ProxyJump
(ssh -J) through a dedicated bastion instead of agent forwarding. Bastions need TCP forwarding
for ProxyJump: exclude this control there, or allow it for a group of users with a
Match Group block.
Applies when
Detected: when: OpenSSH server is installed A scanner reports the control not applicable when one is false.
Setting
| Location | /etc/ssh/sshd_config.d/00-cirsec.conf |
| Default | no |
| Recommended | yes |
Audit
Run sshd -T | grep '^disableforwarding '. It must print disableforwarding yes.
Automated: every check must pass. Scanners report each check by its id.
disable-forwarding
DisableForwarding.
key: disableforwarding
value: yes
Remediation
Add DisableForwarding yes to /etc/ssh/sshd_config.d/00-cirsec.conf, check with sshd -t,
then run systemctl reload ssh.
| Restart | service: ssh |
| Disruption | low |
| Lockout risk | yes: can cut off administrative access. Off by default in generated scripts and playbooks, opt in through a tailoring file. |
Rollback
Remove the line and run systemctl reload ssh.
disable-forwarding
Generated from check disable-forwarding: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- sshd_config(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
- NIST IR 7966 - Security of Interactive and Automated Access Management Using Secure Shell (SSH) NIST, guide, accessed 2026-10-18
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | CM-7 | related | |
| NIST SP 800-53 Rev. 55.1.1 | AC-17 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
People and lifecycle
| Authors |
|
| Verified | 2026-10-18 by Sn0wAlice on 12, Proxmox VM 921, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64. Generated fix; SSH by key still accepted after the fix and after reboot. |
| Verified | 2026-10-18 by Sn0wAlice on 13, Proxmox VM 931, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64. Generated fix; SSH by key still accepted after the fix and after reboot. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-18, 2026-10-18 |
| Translations | fr |
