Disable SSH Forwarding
Forces DisableForwarding yes, the master switch that turns off all SSH forwarding (TCP, X11, agent, StreamLocal, tun).
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
SSH forwarding lets an authenticated client tunnel arbitrary traffic through the server: TCP forwarding can be used to pivot into the internal network or bypass firewall segmentation, X11 and agent forwarding can leak credentials back to a compromised endpoint. Unless there is an operational need, DisableForwarding yes shuts every forwarding type in one directive, removing a powerful lateral-movement and exfiltration vector.
What Pavois checks
Pavois reads the effective value from sshd -T. DisableForwarding interacts with AllowTcpForwarding, X11Forwarding, AllowAgentForwarding and per-user Match overrides; only the resolved output shows the true result after all includes and drop-ins, which a raw read of /etc/ssh/sshd_config cannot.
describe command('sshd -T') do
its('stdout') { should match(/^disableforwarding\s+yes$/i) }
endHow to verify it is applied
Run sshd -T | grep -i '^disableforwarding'. Expected output is disableforwarding yes.
Inspect & investigate
Refused forwarding attempts are logged in /var/log/auth.log (Debian/Ubuntu) or journalctl -u sshd (RHEL family), e.g. lines mentioning refused local port forward when a client tries to open a tunnel.
Remediation
Pavois's harden plan writes the sshd_setting directive DisableForwarding yes in a managed drop-in, validates with sshd -t, then reloads the ssh service. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| directive | disableforwarding |
|---|---|
| notify | action: reload, service: ssh.service |
| resource | sshd_setting |
| value | yes |
| verify | sshd -t -f %{path} |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Before applying, confirm no workflow depends on SSH tunnels: ssh -L/-R/-D port forwards, git/rsync over jump hosts that proxy, X11-forwarded GUI apps (ssh -X), or ForwardAgent for chained logins. If any are needed, scope an exception with a Match block instead of forwarding globally. This change does not affect plain shell logins and the reload keeps current sessions alive.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.1.8, 5.1.10 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.