MediumSSHBLWK-SSH-005

SSH TCP forwarding/tunneling is enabled

What this means

AllowTcpForwarding is set to “‹allow tcp forwarding›” in sshd_config. TCP forwarding lets any SSH user open arbitrary local or remote port tunnels through this host — the exact mechanism used to pivot into internal networks or to reach services (like VNC) that are only supposed to be reachable from localhost.

How to fix it

Set AllowTcpForwarding no in /etc/ssh/sshd_config, or restrict it per-user with a Match block, unless tunneling is a deliberate requirement.

Check it yourself

Run a scan and look for BLWK-SSH-005 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads sshd_config and reports this check when:

allow_tcp_forwarding == "yes"

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 5.2.5
• MITRE ATT&CK T1572

Related checks

• SSH password authentication is enabled · BLWK-SSH-001
• SSH root login is permitted · BLWK-SSH-002
• SSH allows empty passwords · BLWK-SSH-003
• SSH X11 forwarding is enabled · BLWK-SSH-004
• SSH permits user-set environment variables · BLWK-SSH-006
• SSH tun-device (layer 2/3) tunneling is enabled · BLWK-SSH-007