The ESXi host Secure Shell (SSH) daemon must be configured to not allow gateway ports.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
low	V-256391	SRG-OS-000480-VMM-002000	ESXI-70-000022	SV-256391r959010_rule	2025-02-11	1

Description
SSH Transmission Control Protocol (TCP) connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide convenience similar to a virtual private network (VPN) with the similar risk of providing a path to circumvent firewalls and network Access Control Lists (ACLs). Gateway ports allow remote forwarded ports to bind to nonloopback addresses on the server.

Description

SSH Transmission Control Protocol (TCP) connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide convenience similar to a virtual private network (VPN) with the similar risk of providing a path to circumvent firewalls and network Access Control Lists (ACLs). Gateway ports allow remote forwarded ports to bind to nonloopback addresses on the server.

ℹ️ Check
From an ESXi shell, run the following command: # /usr/lib/vmware/openssh/bin/sshd -T\|grep gatewayports Expected result: gatewayports no If the output does not match the expected result, this is a finding.

✔️ Fix
From an ESXi shell, add or correct the following line in "/etc/ssh/sshd_config": GatewayPorts no