lowaccess-controlverified ✓rollback-safe
Restrict SSH X11 forwarding to localhost
ssh-x11-use-localhost · RHEL ≥ 8, UBUNTU ≥ 22 · 2 impls
Description
The SSH daemon must bind X11 forwarding to the loopback address only. X11UseLocalhost controls whether the forwarded X11 display server binds to localhost or to the wildcard address, which determines whether remote hosts can connect to the proxy display.
Rationale
When X11UseLocalhost is disabled, the X11 proxy display listens on all interfaces, allowing any host on the network to connect to the forwarded display. An attacker on the same network could intercept keystrokes and screen contents or inject input into the forwarded X11 session.
Check → Remediate
Checksshd_effective_config
- key:
- x11uselocalhost
- expected:
- yes
Remediateconfig_set
- path:
- /etc/ssh/sshd_config
- key:
- X11UseLocalhost
- value:
- yes
- separator:
- reload:
- sshd
Framework references
STIG
V-230556 / RHEL-08-040341V-270709 / UBTU-24-300023V-260530 / UBTU-22-255045V-281261 / RHEL-10-700580V-258011 / RHEL-09-255175
NIST 800-53
CM-6
Live verification
rhel10:checkrhel8:checkrhel9:checkubuntu22:checkubuntu24:checkubuntu26:check
#ssh#x11#forwarding