mediumaccess-controlverified ✓✓rollback-safe
Disable SSH X11 forwarding
ssh-x11-forwarding · RHEL ≥ 8, UBUNTU ≥ 22 · 2 impls
Description
The SSH daemon must disable X11 forwarding. X11Forwarding controls whether the server tunnels X11 traffic over the SSH session; when set to no, remote X clients cannot be forwarded through the daemon.
Rationale
X11 forwarding exposes the local X server to clients on the remote host. A compromised or malicious remote host with a forwarded X11 channel can capture keystrokes and screen contents or inject input into the local session. Disabling X11 forwarding removes that attack surface entirely.
Check → Remediate
Checksshd_effective_config
- key:
- x11forwarding
- expected:
- no
Remediateconfig_set
- path:
- /etc/ssh/sshd_config
- key:
- X11Forwarding
- value:
- no
- separator:
- reload:
- sshd
Framework references
STIG
V-230555 / RHEL-08-040340V-258007 / RHEL-09-255155V-281258 / RHEL-10-700550V-270708 / UBTU-24-300022V-260529 / UBTU-22-255040
NIST 800-53
CM-6CM-7
Live verification
rhel10:checkubuntu22:fullubuntu24:full
#ssh#x11#forwarding