Other Articles

Servers – Disable SSH AllowTcpForwarding

Support > Fixing Checks > Server

06 March, 2026

This check ensures that SSH TCP forwarding is disabled on the server.

Allowing TCP forwarding can enable unauthorized tunneling of network traffic, which may be exploited for bypassing security controls, establishing backdoors, or exfiltrating sensitive data.

Check Details

  • Resource: Server
  • Check: Ensure SSH AllowTcpForwarding is disabled
  • Risk: Enabled TCP forwarding can allow attackers to create encrypted tunnels for unauthorized access or data exfiltration.

Remediation Steps

  1. Open a terminal session with root or sudo privileges.

  2. Verify current configuration:

    sshd -T | grep -i allowtcpforwarding

  3. Ensure the output is set to:

    AllowTcpForwarding no

  4. Edit SSH configuration file:

    sudo nano /etc/ssh/sshd_config

  5. Add or modify the following line:

    AllowTcpForwarding no
  6. Save the file and exit.

  7. Restart SSH service:

    sudo systemctl restart sshd
  8. Re-run the audit command to confirm the configuration is applied.
  9. Perform regular audits to ensure the setting is not reverted.