Disable SSH X11 Forwarding
Forbid the SSH server from tunnelling graphical sessions back to the client (X11Forwarding no). The X11 protocol has no isolation between clients: a compromised server that receives a forwarded display can read the user's keystrokes and screen contents on their workstation.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
What Pavois checks
Pavois runs sshd -T and requires the resolved line x11forwarding no. sshd -T prints the configuration the daemon really applies, after all Include directives and every drop-in in /etc/ssh/sshd_config.d/. This matters here because distributions and desktop packages routinely ship drop-ins that set X11Forwarding yes: grepping /etc/ssh/sshd_config alone would report a compliant host while the daemon is forwarding X11.
describe command('sshd -T') do
its('stdout') { should match(/^x11forwarding\s+no$/i) }
endHow to verify it is applied
Run sshd -T | grep -i x11forwarding as root. Expected output:
x11forwarding no
End to end: ssh -X user@host 'echo $DISPLAY' must print an empty line, and the client displays X11 forwarding request failed on channel 0.
Inspect & investigate
At the default LogLevel INFO, a refused X11 request is not logged. Raise the daemon to LogLevel VERBOSE and sshd records, in /var/log/auth.log (Debian/Ubuntu), /var/log/secure (RHEL) or journalctl -u ssh:
sshd[1234]: X11 forwarding disabled in server configuration file.
That line is the cheapest way to inventory the users and jobs still asking for a display before enforcing the rule fleet-wide.
Remediation
The Pavois harden plan uses the sshd_setting resource to force the directive x11forwarding to no in the Pavois drop-in under /etc/ssh/sshd_config.d/. Because the drop-in is read after the distribution's own files, it wins over a packaged X11Forwarding yes. The file is validated with sshd -t -f <file>, then a change notifies a reload of ssh.service.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| directive | x11forwarding |
|---|---|
| notify | action: reload, service: ssh.service |
| resource | sshd_setting |
| value | no |
| verify | sshd -t -f %{path} |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
With X11 forwarding on, any root-level compromise of the server gives access to the forwarded $DISPLAY of every connected user: keylogging and screen capture on their workstation, plus the extra listening socket sshd opens for the proxy display. Before applying, check for admins who launch graphical tools over SSH (virt-manager, xclock, installers, vendor consoles) and for scripts that assume $DISPLAY is set; the supported replacements are a local client, a web console, or an explicit, per-host exception. The reload does not break running sessions: only new ones lose the display.