ESXI-06-000018 – The SSH daemon must not permit GSSAPI authentication.
Details GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system’s...
- Home
- Security Hardening
- DISA STIG VMware vSphere 6.x ESXi OS V1R5
DISA STIG VMware vSphere 6.x ESXi OS V1R5
ESXI-06-000019 – The SSH daemon must not permit Kerberos authentication.
Details Kerberos authentication for SSH is often implemented using GSSAPI. If Kerberos is enabled through SSH, the SSH daemon provides...ESXI-06-000020 – The SSH daemon must perform strict mode checking of home directory configuration files.
Details If other users have access to modify user-specific SSH configuration files, they may be able to log into the...ESXI-06-000021 – The SSH daemon must not allow compression or must only allow compression after successful authentication.
Details If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in...ESXI-06-000022 – The SSH daemon must be configured to not allow gateway ports.
Details SSH TCP connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can...ESXI-06-000023 – The SSH daemon must be configured to not allow X11 forwarding.
Details X11 forwarding over SSH allows for the secure remote execution of X11-based applications. This feature can increase the attack...ESXI-06-000025 – The SSH daemon must not permit tunnels.
Details OpenSSH has the ability to create network tunnels (layer-2 and layer-3) over an SSH connection. This function can provide...ESXI-06-000026 – The SSH daemon must set a timeout count on idle sessions.
Details This ensures a user login will be terminated as soon as the ‘ClientAliveCountMax’ is reached. Solution To set the...ESXI-06-000027 – The SSH daemon must set a timeout interval on idle sessions.
Details Causing idle users to be automatically logged out guards against compromises one system leading trivially to compromises on another....ESXI-06-000028 – The SSH daemon must limit connections to a single session.
Details The SSH protocol has the ability to provide multiple sessions over a single connection without reauthentication. A compromised client...