← Rules Catalog
lowaccess-controlverified rollback-safe

Restrict SSH X11 forwarding to localhost

ssh-x11-use-localhost · RHEL ≥ 8, UBUNTU ≥ 22 · 2 impls

Description

The SSH daemon must bind X11 forwarding to the loopback address only. X11UseLocalhost controls whether the forwarded X11 display server binds to localhost or to the wildcard address, which determines whether remote hosts can connect to the proxy display.

Rationale

When X11UseLocalhost is disabled, the X11 proxy display listens on all interfaces, allowing any host on the network to connect to the forwarded display. An attacker on the same network could intercept keystrokes and screen contents or inject input into the forwarded X11 session.

Check → Remediate

Checksshd_effective_config
key:
x11uselocalhost
expected:
yes
Remediateconfig_set
path:
/etc/ssh/sshd_config
key:
X11UseLocalhost
value:
yes
separator:
reload:
sshd

Framework references

STIG

V-230556 / RHEL-08-040341V-270709 / UBTU-24-300023V-260530 / UBTU-22-255045V-281261 / RHEL-10-700580V-258011 / RHEL-09-255175

NIST 800-53

CM-6

Live verification

rhel10:checkrhel8:checkrhel9:checkubuntu22:checkubuntu24:checkubuntu26:check
#ssh#x11#forwarding