Skip to content

The ESXi host Secure Shell (SSH) daemon must be configured to not allow gateway ports.

An XCCDF Rule

Description

SSH Transmission Control Protocol (TCP) connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide convenience similar to a virtual private network (VPN) with the similar risk of providing a path to circumvent firewalls and network Access Control Lists (ACLs). Gateway ports allow remote forwarded ports to bind to nonloopback addresses on the server.

ID
SV-258763r959010_rule
Version
ESXI-80-000207
Severity
Low
References
Updated

Remediation Templates

A Manual Procedure

From an ESXi shell, run the following command:

# esxcli system ssh server config set -k gatewayports -v no

or