{
  "id": "CB-UBU-NET-018",
  "standard": "ubuntu",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-NET-018",
  "json": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-NET-018.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-NET-018.yml",
  "profiles_effective": [
    "server-hardened",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-NET-018",
    "title": "Disable SSH forwarding",
    "finding": {
      "title": "SSH sessions can forward ports, sockets, X11 and the SSH agent",
      "description": "Forwarding turns any SSH account into a tunnel through the firewall, in either direction."
    },
    "status": "active",
    "profiles": [
      "server-hardened",
      "desktop-hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "ssh",
      "forwarding",
      "tunneling"
    ],
    "applicability": {
      "facts": [
        "openssh-server"
      ]
    },
    "description": "`DisableForwarding yes` in the OpenSSH server turns off every kind of forwarding at once: TCP\nport forwarding (`ssh -L`, `-R`, `-D`), Unix socket forwarding, X11 forwarding and SSH agent\nforwarding, whatever the other `*Forwarding` options say.\n",
    "rationale": "With forwarding, a user or an attacker holding any SSH account can open tunnels to internal\nservices that the firewall does not expose, or expose the server's network to the outside\n(reverse tunnels). X11 and agent forwarding let a compromised server act on the client's\ndisplay or reuse its keys.\n",
    "impact": "Administrators lose `ssh -L/-R/-D` tunnels, `ssh -A` (agent forwarding, used to hop to other\nhosts or to `git` with the local key) and `ssh -X`. To reach other hosts, use `ProxyJump`\n(`ssh -J`) through a dedicated bastion instead of agent forwarding. Bastions need TCP forwarding\nfor `ProxyJump`: exclude this control there, or allow it for a group of users with a\n`Match Group` block.\n",
    "setting": {
      "location": "/etc/ssh/sshd_config.d/00-cirsec.conf",
      "default_value": "no",
      "recommended_value": "yes"
    },
    "audit": {
      "manual": "Run `sshd -T | grep '^disableforwarding '`. It must print `disableforwarding yes`.\n",
      "checks": [
        {
          "id": "disable-forwarding",
          "engine": "sshd-config",
          "description": "DisableForwarding.",
          "spec": {
            "key": "disableforwarding",
            "value": "yes"
          }
        }
      ]
    },
    "remediation": {
      "manual": "Add `DisableForwarding yes` to `/etc/ssh/sshd_config.d/00-cirsec.conf`, check with `sshd -t`,\nthen run `systemctl reload ssh`.\n",
      "effects": {
        "restart": "service",
        "services": [
          "ssh"
        ],
        "disruption": "low",
        "lockout_risk": true
      },
      "rollback": "Remove the line and run `systemctl reload ssh`.\n",
      "scripts": [
        {
          "id": "disable-forwarding",
          "from_check": "disable-forwarding"
        }
      ]
    },
    "references": [
      {
        "title": "sshd_config(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/sshd_config.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "NIST IR 7966 - Security of Interactive and Automated Access Management Using Secure Shell (SSH)",
        "url": "https://csrc.nist.gov/pubs/ir/7966/final",
        "publisher": "NIST",
        "kind": "guide",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-17",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1572"
      },
      {
        "framework": "mitre-attack",
        "id": "T1090"
      },
      {
        "framework": "cwe",
        "id": "CWE-284"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic, BIOS boot",
        "notes": "Profile server-hardened; generated fix; SSH by key still accepted after the fix and after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic, BIOS boot",
        "notes": "Profile server-hardened; generated fix; SSH by key still accepted after the fix and after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot",
        "notes": "Profile server-hardened; generated fix; SSH by key still accepted after the fix and after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot",
        "notes": "Profile server-hardened; generated fix; SSH by key still accepted after the fix and after reboot."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}