Check Details

• Resource: Server
• Check: Ensure SSH X11 forwarding is disabled
• Risk: Enabling X11 forwarding may expose the system to unauthorized access or compromise of remote graphical sessions.

Remediation Steps

1. Open a terminal session on the server with root or sudo privileges.

2. Edit the SSH daemon configuration file:

   

   sudo nano /etc/ssh/sshd_config
   

3. Locate or add the following line in the configuration file:

   

   X11Forwarding no
   

4. Save the file and exit the editor.

5. Restart the SSH service to apply changes:

   

   sudo systemctl restart sshd
   

6. Verify that X11 forwarding is disabled:

   

   sshd -T | grep x11forwarding
   

7. Confirm that the output shows:

   X11Forwarding no
8. Perform regular configuration audits to ensure this setting remains enforced.

Additional Information

Disable X11 forwarding unless there is a clear operational requirement. While users may still configure their own forwarding tools, disabling it at the SSH daemon level prevents the most common method of exploitation.

X11 forwarding should only be enabled when there is a legitimate need for remote graphical applications. For most server environments, it should remain disabled.