← Back to IBM AIX 7.x Security Technical Implementation Guide

V-215300

CAT II (Medium)

AIX must turn off X11 forwarding for the SSH daemon.

Rule ID

SV-215300r991589_rule

STIG

IBM AIX 7.x Security Technical Implementation Guide

Version

V3R2

CCIs

CCI-000366

Discussion

X11 forwarding over SSH allows for the secure remote execution of X11-based applications. This feature can increase the attack surface of an SSH connection and should not be enabled unless needed.

Check Content

If X11 forwarding has been authorized for use, this is Not Applicable.

Check the SSH daemon configuration for the "X11Forwarding" directive using command: 

# grep -i X11Forwarding /etc/ssh/sshd_config | grep -v '^#' 
X11Forwarding no

If the setting is not present or the setting is "yes", this is a finding.

Fix Text

Edit the "/etc/sshd/sshd_config" file to add the following line and save the change:
X11Forwarding no

Restart the SSH daemon:
# stopsrc -s sshd
# startsrc -s sshd