SSH GatewayPorts exposes forwarded ports to the network
What this means
GatewayPorts is set to “‹gateway ports›” in sshd_config. By default, a port an SSH client forwards to this host is only reachable from localhost; with GatewayPorts on, it's reachable from anywhere on the network — turning an individual user's ad-hoc SSH tunnel into an accidental (or deliberate) network-wide exposure of whatever it points at.
How to fix it
Set GatewayPorts no in /etc/ssh/sshd_config and run systemctl restart sshd.
Check it yourself
Run a scan and look for BLWK-SSH-009 in the results:
sh
bulwark scanInstalled the standalone CLI package instead of the app? The command is bulwarkctl.
How Bulwark decides
Bulwark reads sshd_config and reports this check when:
text
gateway_ports == "yes"If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.
References
Related checks
- SSH password authentication is enabled ·
BLWK-SSH-001 - SSH root login is permitted ·
BLWK-SSH-002 - SSH allows empty passwords ·
BLWK-SSH-003 - SSH X11 forwarding is enabled ·
BLWK-SSH-004 - SSH TCP forwarding/tunneling is enabled ·
BLWK-SSH-005 - SSH permits user-set environment variables ·
BLWK-SSH-006